PT-2007-2697 · Adobe · Robohelp+1

Published 2007-05-09 · Updated 2025-04-23 · CVE-2007-1280

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adobe RoboHelp versions X5, 6 Adobe RoboHelp Server version 6

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a URL after a # (hash) in the URL path. This can be demonstrated using specific files such as en/frameset-7.html. Other potential vectors involve templates and various files including whstart.js, whcsh home.htm in WebHelp, wf startpage.js, wf startqs.htm in FlashHelp, or WindowManager.dll in RoboHelp Server 6.

Recommendations For Adobe RoboHelp versions X5 and 6, update to a version that includes the fix for this issue. For Adobe RoboHelp Server version 6, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the specified files and templates until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2007-1280

Affected Products

Robohelp

Robohelp Server

References · 13

• 🔥 https://exploit-db.com/exploits/30016 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1280 · Security Note
• http://securityfocus.com/bid/23878 · Patch
• http://adobe.com/support/security/bulletins/apsb07-10.html · Vendor Advisory
• http://secunia.com/advisories/25211 · Vendor Advisory
• http://osvdb.org/35867 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1280 · Note
• http://vupen.com/english/advisories/2007/1714 · Note
• http://securityfocus.com/archive/1/468360/100/0/threaded · Note
• https://t.me/cvenotify/119556 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34181 · Note
• http://devtarget.org/adobe-advisory-05-2007.txt · Note
• http://securitytracker.com/id?1018020 · Note