CVE-2007-2385: Medium severity Yahoo Ui Library vulnerability

Published Apr 30, 2007

Updated

The Yahoo! UI framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."

Affected Software

1 affected component

Yahoo Ui Library

Event History

Apr 30, 2007

CVE Published

via NVD·11:19 PM

May 1, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2385?

CVE-2007-2385 is classified as a moderate severity vulnerability due to the risk of data exposure.

How do I fix CVE-2007-2385?

To fix CVE-2007-2385, ensure that the Yahoo! UI framework is updated to its latest version which includes security protections.

What systems are affected by CVE-2007-2385?

CVE-2007-2385 affects all versions of the Yahoo! UI Library.

What type of attack does CVE-2007-2385 allow?

CVE-2007-2385 allows remote attackers to hijack JavaScript data via insecure JSON exchanges.

Can CVE-2007-2385 be exploited through any web page?

Yes, CVE-2007-2385 can be exploited through any web page that retrieves data using a vulnerable Yahoo! UI framework.