« Volver al listado

CVE-2007-6640

Estado: ModificadaMedia (6.4)—

Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Sourceforge — CreammonkeySourceforge — Greasekit

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-6640",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-01-04T01:46:00.000",
  "references": [
    {
      "url": "http://8-p.info/greasekit/vuln/20071226-en.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/42819",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28241",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39272",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://8-p.info/greasekit/vuln/20071226-en.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/42819",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28241",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39272",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured."
    },
    {
      "lang": "es",
      "value": "Creammonkey 0.9 hasta 1.1 y GreaseKit 1.2 hasta v1.3 no evita apropiadamente el acceso a funciones peligrosas, lo cual permite a atacantes remotos leer la configuración, modificarla, ó enviar una petición HTTP mediante la función (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, ó (6) GM_xmlhttpRequest sin una página web en la cual el script de usuario sea configurado."
    }
  ],
  "lastModified": "2026-06-16T22:48:29.483",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sourceforge:creammonkey:0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C352EAE2-12E3-4E07-A3FD-2FE0C212AFD0"
            },
            {
              "criteria": "cpe:2.3:a:sourceforge:creammonkey:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F30228EB-E9FA-4CFB-B3E3-79A0C069F33E"
            },
            {
              "criteria": "cpe:2.3:a:sourceforge:creammonkey:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05B7F0FD-2DE5-45FE-BFFB-9648720705BC"
            },
            {
              "criteria": "cpe:2.3:a:sourceforge:greasekit:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB16097A-0A1F-412B-9DD4-56779A2B6B9E"
            },
            {
              "criteria": "cpe:2.3:a:sourceforge:greasekit:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CA950CE-E29A-44B3-B2A3-03C734BBDAA6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}