PT-2009-6302 · Wikipedia · Wikipedia Toolbar

Published 2009-12-02 · Updated 2024-03-12 · CVE-2009-4127

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wikipedia Toolbar extension versions prior to 0.5.9.2

Description The issue allows user-assisted remote attackers to execute arbitrary JavaScript with Chrome privileges. This is achieved via vectors involving unspecified Toolbar buttons and the eval function.

Recommendations For versions prior to 0.5.9.2, update to version 0.5.9.2 or later to resolve the issue. As a temporary workaround, consider disabling the use of unspecified Toolbar buttons until a patch is available. Avoid using the eval function in the affected extension until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-4127

ROSA-SA-2024-2370

Affected Products

Wikipedia Toolbar

References · 55

• https://nvd.nist.gov/vuln/detail/CVE-2007-5274 · Security Note
• https://bdu.fstec.ru/vul/2015-02790 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3478 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1597 · Security Note
• https://bdu.fstec.ru/vul/2015-01739 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2003-1492 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-6715 · Security Note
• https://bdu.fstec.ru/vul/2015-02793 · Security Note
• https://bdu.fstec.ru/vul/2015-02789 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-1970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-2794 · Security Note
• https://bdu.fstec.ru/vul/2015-06539 · Security Note
• http://secunia.com/advisories/37377 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03444 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-4102 · Security Note