CVE-2006-6990

Cross-domain vulnerability in Enigma Browser 3.8.8 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:advanced_search_technologies_inc.:enigma_browser:3.8.8:*:*:*:*:*:*:*

History

21 Nov 2024, 00:24

Type	Values Removed	Values Added
References	~~() http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html -~~	() http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html -

Information

Published : 2007-02-09 01:28

Updated : 2024-11-21 00:24

NVD link : CVE-2006-6990

Mitre link : CVE-2006-6990

CVE.ORG link : CVE-2006-6990

JSON object : View

Products Affected

advanced_search_technologies_inc.

enigma_browser

CWE

NVD-CWE-Other

{"id": "CVE-2006-6990", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-02-09T01:28:00.000", "references": [{"url": "http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html", "source": "cve@mitre.org"}, {"url": "http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-domain vulnerability in Enigma Browser 3.8.8 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280."}, {"lang": "es", "value": "Vulnerabilidad de cruzado de dominios en Enigma Browser 3.8.8 permite a atacantes remotos acceder a informaci\u00f3n restringida desde otros dominios mediante una etiqueta de objeto, con un par\u00e1metro de datos que referencia un enlace en el sitio de origen de ataque, que especifica una cabecera Location HTTP la cual referencia el sitio destino, de esta manera hace aquel contenido disponible a trav\u00e9s del atributo outerHTML en el objeto, vulnerabilidad similar a CVE-2006-3280."}], "lastModified": "2024-11-21T00:24:07.510", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:advanced_search_technologies_inc.:enigma_browser:3.8.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36E5C0EB-BC2B-481D-A4DB-C3096699569A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}