PT-2008-1603 · Null · Greasekit+1

Publicado

2008-01-04

·

Atualizado

2017-08-08

·

CVE-2007-6640

CVSS v2.0

6.4

Média

VetorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Creammonkey versions 0.9 through 1.1 GreaseKit versions 1.2 through 1.3
Description The issue allows remote attackers to access and manipulate sensitive functions within a web page where a userscript is configured. This can lead to reading the configuration, modifying the configuration, or sending an HTTP request via specific functions, including (1) GM addStyle, (2) GM log, (3) GM openInTab, (4) GM setValue, (5) GM getValue, or (6) GM xmlhttpRequest.
Recommendations For Creammonkey versions 0.9 through 1.1, consider disabling the GM addStyle, GM log, GM openInTab, GM setValue, GM getValue, and GM xmlhttpRequest functions until a patch is available. For GreaseKit versions 1.2 through 1.3, restrict access to the functions GM addStyle, GM log, GM openInTab, GM setValue, GM getValue, and GM xmlhttpRequest to minimize the risk of exploitation.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-6640

Produtos afetados

Creammonkey
Greasekit