« Volver al listado

CVE-2007-2383

Estado: ModificadaMedia (5)—

The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Prototypejs — Prototype Framework

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-2383",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-04-30T23:19:00.000",
  "references": [
    {
      "url": "http://dev.rubyonrails.org/ticket/7910",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://prototypejs.org/2007/4/24/release-candidate-3",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/37677",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1952",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf",
      "tags": [
        "URL Repurposed"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://dev.rubyonrails.org/ticket/7910",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://prototypejs.org/2007/4/24/release-candidate-3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37677",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1952",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf",
      "tags": [
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka \"JavaScript Hijacking.\""
    },
    {
      "lang": "es",
      "value": "El framework Prototype (prototypejs) versiones anteriores a  1.5.1 RC3, intercambia datos usando JavaScript Object Notation (JSON) sin un esquema de protección asociado, lo que permite a atacantes remotos obtener los datos por medio de una página web que recupera los datos por medio de una URL en el atributo SRC de un elemento SCRIPT y captura los datos usando otro código JavaScript, también se conoce como \"JavaScript Hijacking\"."
    }
  ],
  "lastModified": "2026-06-16T22:39:28.637",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:prototypejs:prototype_framework:1.5.1_rc3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EDF1725-D410-4E5A-976C-C5ABA4F2B7C4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}