CVE-2007-6640 Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or...
MediumCVSS 6.4
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sourceforge creammonkey | = 0.9 | No fix listed |
| sourceforge creammonkey | = 1.0 | No fix listed |
| sourceforge creammonkey | = 1.1 | No fix listed |
| sourceforge greasekit | = 1.2 | No fix listed |
| sourceforge greasekit | = 1.3 | No fix listed |
References
- 8-p.info
- 42819 vdb-entry
- 28241 third-party-advisory
- greasekit-creammonkey-gm-security-bypass(39272) vdb-entry