AIM Arbitrary HTML Display in Notification Window

2007.09.17
Credit: shell
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2007-4901
CWE: CWE-noinfo


CVSS Base Score: 5.8/10
Impact Subscore: 4.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: None

Arbitrary HTML can be readily displayed in notification windows generated by AOL Instant Messenger when the window of origin is not the main focus. This vulnerability is known to be present at least in version 6.1.41.2 (which is the current release). It appears to display any form of HTML-compliant code. More details can be provided on request. Discovery credited to: Shell ( dotshell.net, shell6 (at) gmail (dot) com [email concealed], shell (at) dotshell (dot) net [email concealed]) Lone (Lone-Matrix.com, Lone (at) Lone-Matrix (dot) com [email concealed] )


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top