CVE-2007-2398 - Vulnerability Details - OpenCVE

Apple Safari 3.0.1 beta (522.12.12) on Windows allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content by setting the location bar and using setTimeout() to create an event that modifies the window content, which could facilitate phishing attacks.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Complete

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apple	Safari
Microsoft	Windows 2003 Server

Configuration 1 [-]

AND

cpe:2.3:o:microsoft:windows_2003_server:sp2:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:3.0.1:*:windows:*:*:*:*:*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0311.html
http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html
http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html
http://osvdb.org/38862
http://support.apple.com/kb/HT1467
http://www.securityfocus.com/archive/1/471452/100/0/threaded
http://www.securityfocus.com/archive/1/471454/100/0/threaded
http://www.securityfocus.com/bid/24484
http://www.securitytracker.com/id?1018282
http://www.vupen.com/english/advisories/2007/2316
http://www.vupen.com/english/advisories/2008/0979/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/35050

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-06-21T10:00:00

Updated: 2024-08-07T13:33:28.675Z

Reserved: 2007-04-30T00:00:00

Link: CVE-2007-2398

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-06-21T10:30:00.000

Modified: 2024-11-21T00:30:41.423

Link: CVE-2007-2398

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-06-14T00:00:00", "descriptions": [{"lang": "en", "value": "Apple Safari 3.0.1 beta (522.12.12) on Windows allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content by setting the location bar and using setTimeout() to create an event that modifies the window content, which could facilitate phishing attacks."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "38862", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/38862"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://support.apple.com/kb/HT1467"}, {"name": "ADV-2007-2316", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/2316"}, {"name": "ADV-2008-0979", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/0979/references"}, {"name": "APPLE-SA-2007-06-22", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html"}, {"name": "APPLE-SA-2008-04-16", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html"}, {"name": "1018282", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1018282"}, {"name": "20070614 Re: Apple Safari: urlbar/window title spoofing", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0311.html"}, {"name": "safari-addressbar-spoofing(35050)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35050"}, {"name": "20070614 Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/471452/100/0/threaded"}, {"name": "24484", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/24484"}, {"name": "20070615 Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/471454/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-2398", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Apple Safari 3.0.1 beta (522.12.12) on Windows allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content by setting the location bar and using setTimeout() to create an event that modifies the window content, which could facilitate phishing attacks."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "38862", "refsource": "OSVDB", "url": "http://osvdb.org/38862"}, {"name": "http://support.apple.com/kb/HT1467", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT1467"}, {"name": "ADV-2007-2316", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/2316"}, {"name": "ADV-2008-0979", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/0979/references"}, {"name": "APPLE-SA-2007-06-22", "refsource": "APPLE", "url": "http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html"}, {"name": "APPLE-SA-2008-04-16", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html"}, {"name": "1018282", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1018282"}, {"name": "20070614 Re: Apple Safari: urlbar/window title spoofing", "refsource": "FULLDISC", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0311.html"}, {"name": "safari-addressbar-spoofing(35050)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35050"}, {"name": "20070614 Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/471452/100/0/threaded"}, {"name": "24484", "refsource": "BID", "url": "http://www.securityfocus.com/bid/24484"}, {"name": "20070615 Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/471454/100/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:33:28.675Z"}, "title": "CVE Program Container", "references": [{"name": "38862", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/38862"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://support.apple.com/kb/HT1467"}, {"name": "ADV-2007-2316", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/2316"}, {"name": "ADV-2008-0979", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/0979/references"}, {"name": "APPLE-SA-2007-06-22", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html"}, {"name": "APPLE-SA-2008-04-16", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html"}, {"name": "1018282", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1018282"}, {"name": "20070614 Re: Apple Safari: urlbar/window title spoofing", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0311.html"}, {"name": "safari-addressbar-spoofing(35050)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35050"}, {"name": "20070614 Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/471452/100/0/threaded"}, {"name": "24484", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/24484"}, {"name": "20070615 Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/471454/100/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-2398", "datePublished": "2007-06-21T10:00:00", "dateReserved": "2007-04-30T00:00:00", "dateUpdated": "2024-08-07T13:33:28.675Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_2003_server:sp2:*:*:*:*:*:*:*", "matchCriteriaId": "377F7D0C-6B44-4B90-BF90-DAF959880C6D", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:3.0.1:*:windows:*:*:*:*:*", "matchCriteriaId": "3E61C168-482B-412A-97E8-B1C651797EDF", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Apple Safari 3.0.1 beta (522.12.12) on Windows allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content by setting the location bar and using setTimeout() to create an event that modifies the window content, which could facilitate phishing attacks."}, {"lang": "es", "value": "El Apple Safari 3.0.1 beta (522.12.12) bajo Windows permite a atacantes remotos modificar el t\u00edtulo de una ventana y la barra de direcciones mientras se rellena la ventana principal con contenido de su elecci\u00f3n estableciendo la barra de localizaci\u00f3n y usando el setTimeout() para la creaci\u00f3n de un evento que modifique el contenido de la ventana, lo que puede facilitar ataques de phishing."}], "id": "CVE-2007-2398", "lastModified": "2024-11-21T00:30:41.423", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 7.1, "confidentialityImpact": "NONE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:C/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-06-21T10:30:00.000", "references": [{"source": "cve@mitre.org", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0311.html"}, {"source": "cve@mitre.org", "url": "http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html"}, {"source": "cve@mitre.org", "url": "http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/38862"}, {"source": "cve@mitre.org", "url": "http://support.apple.com/kb/HT1467"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/471452/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/471454/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/24484"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1018282"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/2316"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/0979/references"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35050"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0311.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/38862"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://support.apple.com/kb/HT1467"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/471452/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/471454/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/24484"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1018282"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/2316"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2008/0979/references"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35050"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}