PT-2007-3710 · Getahead · Getahead Dwr

Published 2007-04-30 · Updated 2024-02-14 · CVE-2007-2377

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Getahead Direct Web Remoting (DWR) framework version 1.1.4

Description The issue allows remote attackers to obtain data through a web page that retrieves the data using a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, also known as "JavaScript Hijacking." This occurs because the framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme.

Recommendations For Getahead Direct Web Remoting (DWR) framework version 1.1.4, consider implementing a protection scheme for data exchanged using JavaScript Object Notation (JSON) to prevent unauthorized access. As a temporary workaround, restrict access to sensitive data and consider disabling the use of JSON data exchange until a proper protection scheme is in place.

Fix

Related Identifiers

CVE-2007-2377

Affected Products

Getahead Dwr

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-2377 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• http://osvdb.org/43322 · Note
• http://fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2377 · Note