VulnerabilityModified
CVE-2005-2455
Greasemonkey before 0.3.5 allows remote web servers to (1) read arbitrary files via a GET request to a file:// URL in the GM_xmlhttpRequest API function, (2) list installed scripts using GM_scripts, or obtain sensitive information via (3) GM_setValue…
MEDIUM 5.0EPSS 8.54%
Does this matter?
Lower severity and a low EPSS score (8.54%). Track it; it rarely justifies an emergency change on its own.
Description
Greasemonkey before 0.3.5 allows remote web servers to (1) read arbitrary files via a GET request to a file:// URL in the GM_xmlhttpRequest API function, (2) list installed scripts using GM_scripts, or obtain sensitive information via (3) GM_setValue and GM_getValue.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 8.54% probability · 95th percentile
- CISA KEV
- Not listed
- Affected
- greasemonkey/greasemonkey
- Source
- cve@mitre.org
References
- http://greaseblog.blogspot.com/2005/07/mandatory-greasemonkey-update.htmlPatch
- http://greasemonkey.mozdev.org/changes/0.3.5.htmlPatch
- http://mozdev.org/pipermail/greasemonkey/2005-July/004000.htmlExploit
- http://mozdev.org/pipermail/greasemonkey/2005-July/004022.html
- http://secunia.com/advisories/16128Patch, Vendor Advisory
- http://securitytracker.com/id?1014529Exploit, Patch
- http://www.osvdb.org/18154
- http://www.securiteam.com/securitynews/5CP0P20GBK.htmlExploit, Patch
- http://www.securityfocus.com/bid/14336Exploit, Patch
- http://www.vupen.com/english/advisories/2005/1147
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21453
- http://greaseblog.blogspot.com/2005/07/mandatory-greasemonkey-update.htmlPatch
- http://greasemonkey.mozdev.org/changes/0.3.5.htmlPatch
- http://mozdev.org/pipermail/greasemonkey/2005-July/004000.htmlExploit
- http://mozdev.org/pipermail/greasemonkey/2005-July/004022.html
- http://secunia.com/advisories/16128Patch, Vendor Advisory
- http://securitytracker.com/id?1014529Exploit, Patch
- http://www.osvdb.org/18154
- http://www.securiteam.com/securitynews/5CP0P20GBK.htmlExploit, Patch
- http://www.securityfocus.com/bid/14336Exploit, Patch
- http://www.vupen.com/english/advisories/2005/1147
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21453
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.