medium4.3Public exploit code

CVE-2007-0044

Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauth…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Adobe Reader 9.1.3 Plugin - Cross-Site Scripting2007-01-03 · remote · linux · Verified

Impact

Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."

Affected products

Vendor	Product	Affected versions
Adobe	Acrobat	through 7.0.8 Versions 7.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4
Adobe	Acrobat 3d	All versions
Adobe	Acrobat Reader	through 7.0.8 Versions 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4

Weakness classification

CWE-352

Public exploit code

Impact

Affected products

Weakness classification

References