vulnwire
4.3med

CVE-2007-00441 exploit

Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the br…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
56.8%
percentile 99%
Public exploits
1
Exploit-DB

Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."

Exploit prediction (EPSS)

56.77% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • EDB-29383 Adobe Reader 9.1.3 Plugin - Cross-Site Scripting · remote · 2007-01-03

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

References

  • securityfocus.com /bid/21858 · vdb-entry, x_refsource_BID, x_transferred
  • events.ccc.de /congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf · x_refsource_MISC, x_transferred
  • secunia.com /advisories/23882 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/455801/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • vupen.com /english/advisories/2007/0032 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityreason.com /securityalert/2090 · third-party-advisory, x_refsource_SREASON, x_transferred
  • lists.suse.com /archive/suse-security-announce/2007-Jan/0012.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • secunia.com /advisories/23812 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securitytracker.com /id?1017469 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10042 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/31266 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/29065 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • security.gentoo.org /glsa/glsa-200701-16.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • redhat.com /support/errata/RHSA-2008-0144.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • wisec.it /vulns.php?page=9 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.