Bug 539592 (CVE-2007-2383)

Summary: CVE-2007-2383 embedded prototype.js JavaScript hijacking
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-19 09:03:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 712427    
Description Flags
Upstream patch from git none

Description Josh Bressers 2009-11-20 17:09:07 UTC
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking." 


Comment 1 Josh Bressers 2010-09-29 14:20:09 UTC
Created attachment 450486 [details]
Upstream patch from git

Comment 2 Tomas Hoger 2013-01-28 15:17:14 UTC
(In reply to comment #1)
> Created attachment 450486 [details]
> Upstream patch from git