Unscored severity · published Jan 4, 2008
CVE-2007-6640
Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Creammonkey · Sourceforge
0.9; 1.0; 1.1 · source: NVD
GR
Greasekit · Sourceforge
1.2; 1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-6640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-6640
8-p.info
http://8-p.info/greasekit/vuln/20071226-en.html
osvdb.org
http://osvdb.org/42819
secunia.com
http://secunia.com/advisories/28241
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/39272