Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2007-6640

Overview

Vulnerability Score 6.4 6.4
CVE Id CVE-2007-6640
Last Modified 15 Nov 2008 02:05:41
Published 03 Jan 2008 08:46:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2007-6640

Summary

Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.

Vulnerable Systems

Application

  • Sourceforge Creammonkey 0.9

  • Sourceforge Creammonkey 1.0

  • Sourceforge Creammonkey 1.1

  • Sourceforge Greasekit 1.2

  • Sourceforge Greasekit 1.3


References

XF - greasekit-creammonkey-gm-security-bypass(39272)

SECUNIA - 28241

OSVDB - 42819

CONFIRM - http://8-p.info/greasekit/vuln/20071226-en.html


Last Updated: 27 May 2016 10:46:35