NVD

Id
48868  
Name
CVE-2009-1599  
Description
Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe"s position is "a PDF file is active content."  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-05-11  
Modified Date
2009-05-12  
Seq
2009-1599  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
246947 48868 CVE-2009-1599 http://secniche.org/papers/SNS_09_03_PDF_Silent_Form_Re_Purp_Attack.pdf  View
246948 48868 CVE-2009-1599 20090503 [SecNiche WhitePaper ] - PDF Silent HTTP Form Repurposing Attacks  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41545 JVNDB-2009-002552 Opera における Adobe Acrobat の JavaScript の制限を回避される脆弱性 Opera には、インライン PDF ファイルに含まれる form 内において、submit 要素の target 属性が指定されている際、javascript: URI へのレスポンスに対する DOM コールの実行に関する処理に不備があるため、ドキュメントオブジェクトへのアクセス上で Adobe Acrobat の JavaScript 制限を回避される脆弱性が存在します。 CVE-2009-1599 39030 CVE-2009-1599 48868 9.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002552.html 2009-05-11 2010-09-27 View