Vulnerability Description
Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Acrobat | <= 7.0.8 |
| Adobe | Acrobat 3D | All versions |
| Adobe | Acrobat Reader | <= 7.0.8 |
Related Weaknesses (CWE)
References
- http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
- http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
- http://secunia.com/advisories/23812
- http://secunia.com/advisories/23882Vendor Advisory
- http://secunia.com/advisories/29065Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200701-16.xml
- http://securityreason.com/securityalert/2090Vendor Advisory
- http://securitytracker.com/id?1017469
- http://www.redhat.com/support/errata/RHSA-2008-0144.html
- http://www.securityfocus.com/archive/1/455801/100/0/threaded
- http://www.securityfocus.com/bid/21858
- http://www.vupen.com/english/advisories/2007/0032
- http://www.wisec.it/vulns.php?page=9ExploitPatch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31266
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
FAQ
What is CVE-2007-0044?
CVE-2007-0044 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a ...
How severe is CVE-2007-0044?
CVE-2007-0044 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-0044?
Check the references section above for vendor advisories and patch information. Affected products include: Adobe Acrobat, Adobe Acrobat 3D, Adobe Acrobat Reader.