| ID |
CVE-2007-4424
|
| Summary |
Apple Safari for Windows 3.0.3 and earlier does not prompt the user before downloading a file, which allows remote attackers to download arbitrary files to the desktop of a client system via certain HTML, as demonstrated by a filename in the DATA attribute of an OBJECT element. NOTE: it could be argued that this is not a vulnerability because a dangerous file is not actually launched, but as of 2007, it is generally accepted that web browsers should prompt users before saving dangerous content. |
| References |
|
| Vulnerable Configurations |
-
cpe:2.3:a:apple:safari:3.0.0b:-:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.0b:-:windows:*:*:*:*:*
-
cpe:2.3:a:apple:safari:3.0.1b:-:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.1b:-:windows:*:*:*:*:*
-
cpe:2.3:a:apple:safari:3.0.2b:-:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.2b:-:windows:*:*:*:*:*
|
| CVSS |
| Base: | 4.3 (as of 15-10-2018 - 21:35) |
| Impact: | |
| Exploitability: | |
|
| CWE |
NVD-CWE-Other |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
MEDIUM |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| NONE |
PARTIAL |
NONE |
|
| cvss-vector
via4
|
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
| refmap
via4
|
| bugtraq | - 20070811 Safari for windows remote arbitry file upload
- 20070815 Re: Safari for windows remote arbitry file upload
- 20070820 Re: Re: Safari for windows remote arbitry file upload
| | sectrack | 1018575 | | sreason | 3022 |
|
| Last major update |
15-10-2018 - 21:35 |
| Published |
18-08-2007 - 22:17 |
| Last modified |
15-10-2018 - 21:35 |
