CVE-2007-2060

Cross-zone scripting vulnerability in the Wizz RSS Reader before 2.1.9 extension to Mozilla Firefox allows remote attackers to execute arbitrary Javascript in the browser chrome via the RSS feed DOM.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://addons.mozilla.org/en-US/firefox/addon/424
http://www.kb.cert.org/vuls/id/319464	Patch US Government Resource
http://www.securityfocus.com/bid/23523
http://secunia.com/advisories/24913
http://osvdb.org/34534
http://www.kb.cert.org/vuls/id/MIMG-6ZKP4T
http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/
http://www.vupen.com/english/advisories/2007/1425
https://exchange.xforce.ibmcloud.com/vulnerabilities/33693

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:wizz_computers:wizz_rss_reader:*:*:*:*:*:*:*:*

Information

Published : 2007-04-17 20:19

Updated : 2017-07-28 18:31

NVD link : CVE-2007-2060

Mitre link : CVE-2007-2060

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

wizz_computers

wizz_rss_reader

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://addons.mozilla.org/en-US/firefox/addon/424", "name": "https://addons.mozilla.org/en-US/firefox/addon/424", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.kb.cert.org/vuls/id/319464", "name": "VU#319464", "tags": ["Patch", "US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.securityfocus.com/bid/23523", "name": "23523", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/24913", "name": "24913", "tags": [], "refsource": "SECUNIA"}, {"url": "http://osvdb.org/34534", "name": "34534", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.kb.cert.org/vuls/id/MIMG-6ZKP4T", "name": "http://www.kb.cert.org/vuls/id/MIMG-6ZKP4T", "tags": [], "refsource": "CONFIRM"}, {"url": "http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/", "name": "http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/", "tags": [], "refsource": "MISC"}, {"url": "http://www.vupen.com/english/advisories/2007/1425", "name": "ADV-2007-1425", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33693", "name": "firefox-wizz-rssfeed-xss(33693)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-zone scripting vulnerability in the Wizz RSS Reader before 2.1.9 extension to Mozilla Firefox allows remote attackers to execute arbitrary Javascript in the browser chrome via the RSS feed DOM."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-2060", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": true}}, "publishedDate": "2007-04-18T03:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:wizz_computers:wizz_rss_reader:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.1.8"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-29T01:31Z"}