CVE-2007-2383
published 2007-04-30CVE-2007-2383: The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which…
PriorityP419medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.37%
81.7th percentile
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | asterisk | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| debian | exaile | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| debian | jscropperui | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| debian | libaws | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| debian | libhtml-prototype-perl | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| debian | otrs2 | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| debian | prototypejs | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| debian | scriptaculous | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| debian | symfony | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| debian | wordpress | < asterisk 1:1.6.2.0~rc3-1 (bullseye) | asterisk 1:1.6.2.0~rc3-1 (bullseye) |
| prototypejs | prototype_framework | — | — |
| symfony | symfony | >= 0 < 1.0.21-1.1 | 1.0.21-1.1 |
| symfony | symfony | >= 0 < 1.0.21-1.1 | 1.0.21-1.1 |
| symfony | symfony | >= 0 < 1.0.21-1.1 | 1.0.21-1.1 |
| symfony | symfony | >= 0 < 1.0.21-1.1 | 1.0.21-1.1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qgq2-pf5j-2fvq: The Prototype (prototypejs) framework before 1
ghsa_unreviewed·2022-05-01
CVE-2007-2383 [MEDIUM] GHSA-qgq2-pf5j-2fvq: The Prototype (prototypejs) framework before 1
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
OSV
CVE-2007-2383: The Prototype (prototypejs) framework before 1
osv·2007-04-30·CVSS 5.0
CVE-2007-2383 [MEDIUM] CVE-2007-2383: The Prototype (prototypejs) framework before 1
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Debian
CVE-2007-2383: asterisk - The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using Java...
vendor_debian·2007·CVSS 5.0
CVE-2007-2383 [MEDIUM] CVE-2007-2383: asterisk - The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using Java...
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Scope: local
bullseye: resolved (fixed in 1:1.6.2.0~rc3-1)
sid: resolved (fixed in 1:1.6.2.0~rc3-1)
Red Hat
embedded prototype.js JavaScript hijacking
vendor_redhat·CVSS 5.0
CVE-2007-2383 [MEDIUM] embedded prototype.js JavaScript hijacking
embedded prototype.js JavaScript hijacking
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
No detection rules found.
No public exploits indexed.
http://dev.rubyonrails.org/ticket/7910http://prototypejs.org/2007/4/24/release-candidate-3http://secunia.com/advisories/37677http://www.debian.org/security/2009/dsa-1952http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdfhttp://dev.rubyonrails.org/ticket/7910http://prototypejs.org/2007/4/24/release-candidate-3http://secunia.com/advisories/37677http://www.debian.org/security/2009/dsa-1952http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf
2007-04-30
Published