PT-2007-1199 · Mozilla · Firefox Sage Extension

Published 2007-01-11 · Updated 2018-10-16 · CVE-2006-6919

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Firefox Sage extension versions 1.3.8 and earlier

Description: The issue allows remote attackers to execute arbitrary Javascript in the local context. This can be achieved via an RSS feed with an img tag containing the script followed by an extra trailing >, which the Sage extension modifies to close the img element before the malicious script.

Recommendations: For Firefox Sage extension versions 1.3.8 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-6919

Affected Products

Firefox Sage Extension

References · 7

• 🔥 http://michaeldaw.org/md-hacks/rss-injection-in-sage-part-2 · Exploit
• 🔥 https://exploit-db.com/exploits/28501 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6919 · Security Note
• http://secunia.com/advisories/22809 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30179 · Note
• http://vupen.com/english/advisories/2006/4426 · Note
• http://securityfocus.com/archive/1/452010/100/0/threaded · Note