CVE-2007-0044
Severity:
Pending analysis
Type:
CWE-352
Cross-Site Request Forgery (CSRF)
Publication date:
03/01/2007
Last modified:
16/10/2018
Description
Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."
Impact
Base Score 2.0
4.30
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:adobe:acrobat:*:*:elements:*:*:*:*:* | 7.0.8 (including) | |
cpe:2.3:a:adobe:acrobat:7.0:*:professional:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0:*:standard:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.1:*:professional:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.1:*:standard:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.2:*:professional:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.2:*:standard:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.3:*:professional:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.3:*:standard:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.4:*:professional:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.4:*:standard:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.5:*:professional:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.5:*:standard:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.6:*:professional:*:*:*:*:* | ||
cpe:2.3:a:adobe:acrobat:7.0.6:*:standard:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
- http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
- http://secunia.com/advisories/23812
- http://secunia.com/advisories/23882
- http://secunia.com/advisories/29065
- http://security.gentoo.org/glsa/glsa-200701-16.xml
- http://securityreason.com/securityalert/2090
- http://securitytracker.com/id?1017469=
- http://www.redhat.com/support/errata/RHSA-2008-0144.html
- http://www.securityfocus.com/archive/1/455801/100/0/threaded
- http://www.securityfocus.com/bid/21858
- http://www.vupen.com/english/advisories/2007/0032
- http://www.wisec.it/vulns.php?page=9
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31266
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10042