CVE-2007-0044

CVE-2007-0044 is a medium-severity vulnerability in Adobe Acrobat with a CVSS 2.0 base score of 4.3. Its EPSS exploit-prediction score of 55% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-352.

Key facts

• Severity: Medium (CVSS 2.0 base score 4.3)
• EPSS exploit prediction: 55% (99th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-352
• Affected product: Adobe Acrobat
• Published: 2007-01-03
• Last modified: 2026-06-16

Description

Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."

Frequently asked questions

What is CVE-2007-0044?

Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."

How severe is CVE-2007-0044?

CVE-2007-0044 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2007-0044 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 55% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-0044?

CVE-2007-0044 primarily affects Adobe Acrobat. In total, 36 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2007-0044?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2007-0044 published?

CVE-2007-0044 was published on 2007-01-03 and last updated on 2026-06-16.

References

• http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
• http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
• http://secunia.com/advisories/23812
• http://secunia.com/advisories/23882
• http://secunia.com/advisories/29065
• http://security.gentoo.org/glsa/glsa-200701-16.xml
• http://securityreason.com/securityalert/2090
• http://securitytracker.com/id?1017469
• http://www.redhat.com/support/errata/RHSA-2008-0144.html
• http://www.securityfocus.com/archive/1/455801/100/0/threaded
• http://www.securityfocus.com/bid/21858
• http://www.vupen.com/english/advisories/2007/0032
• http://www.wisec.it/vulns.php?page=9
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31266
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10042

Affected products (36)

• cpe:2.3:a:adobe:acrobat:*:*:elements:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0:*:professional:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0:*:standard:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.1:*:professional:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.1:*:standard:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.2:*:professional:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.2:*:standard:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.3:*:professional:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.3:*:standard:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.4:*:professional:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.4:*:standard:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.5:*:professional:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.5:*:standard:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.6:*:professional:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.6:*:standard:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.7:*:professional:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.7:*:standard:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.8:*:professional:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat:7.0.8:*:standard:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_3d:*:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*

More vulnerabilities in Adobe Acrobat

• CVE-2018-4872 — Critical (CVSS 10.0): An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier…
• CVE-2016-1044 — Critical (CVSS 10.0): Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and…
• CVE-2016-1041 — Critical (CVSS 10.0): Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and…
• CVE-2016-1038 — Critical (CVSS 10.0): Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and…
• CVE-2015-7622 — Critical (CVSS 10.0): Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before…
• CVE-2015-6691 — Critical (CVSS 10.0): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and…

All CVEs affecting Adobe Acrobat →

Other CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities

• CVE-2025-32642 — Critical (CVSS 10.0): Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This…
• CVE-2025-23922 — Critical (CVSS 10.0): Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a…
• CVE-2017-5145 — Critical (CVSS 10.0): An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware…
• CVE-2019-25729 — Critical (CVSS 9.8): PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute…
• CVE-2025-48340 — Critical (CVSS 9.8): Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows…
• CVE-2025-2907 — Critical (CVSS 9.8): The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing…

Browse all CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities →