PT-2007-1199 · Mozilla · Firefox Sage Extension

Publicado 2007-01-11 · Atualizado 2018-10-16 · CVE-2006-6919

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Firefox Sage extension versions 1.3.8 and earlier

Description: The issue allows remote attackers to execute arbitrary Javascript in the local context. This can be achieved via an RSS feed with an img tag containing the script followed by an extra trailing >, which the Sage extension modifies to close the img element before the malicious script.

Recommendations: For Firefox Sage extension versions 1.3.8 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-6919

Produtos afetados

Firefox Sage Extension

Referências · 7

• 🔥 http://michaeldaw.org/md-hacks/rss-injection-in-sage-part-2 · Exploit
• 🔥 https://exploit-db.com/exploits/28501 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6919 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30179 · Nota
• http://vupen.com/english/advisories/2006/4426 · Nota
• http://securityfocus.com/archive/1/452010/100/0/threaded · Nota
• http://secunia.com/advisories/22809 · Aviso do Fabricante