Greasemonkey Multiple Remote Information Disclosure Vulnerabilities

vendor:

Greasemonkey

by:

SecurityFocus

7.5

CVSS

HIGH

Information Disclosure

200

CWE

Product Name: Greasemonkey

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

Greasemonkey Multiple Remote Information Disclosure Vulnerabilities

Greasemonkey is susceptible to multiple remote information disclosure vulnerabilities. These issues are due to a design error allowing insecure JavaScript functions to be executed by remote Web sites. The specified issues exist in the 'GM_xmlhttpRequest()', 'GM_setValue()', and 'GM_scripts()' functions. Other GM_* functions also likely to be affected, but the exact functions are not known at this time. These vulnerabilities allow remote attackers to retrieve the contents of arbitrary files, retrieve directory listings from arbitrary locations, and retrieve the contents of various private Greasemonkey data structures. This aids them in further attacks.

Mitigation:

Ensure that Greasemonkey is updated to the latest version.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/14336/info

Greasemonkey is susceptible to multiple remote information disclosure vulnerabilities. These issues are due to a design error allowing insecure JavaScript functions to be executed by remote Web sites.

The specified issues exist in the 'GM_xmlhttpRequest()', 'GM_setValue()', and 'GM_scripts()' functions.

Other GM_* functions also likely to be affected, but the exact functions are not known at this time.

These vulnerabilities allow remote attackers to retrieve the contents of arbitrary files, retrieve directory listings from arbitrary locations, and retrieve the contents of various private Greasemonkey data structures. This aids them in further attacks. 

http://diveintogreasemonkey.org/experiments/function-leak.html
http://diveintogreasemonkey.org/experiments/script-leak.html
http://diveintogreasemonkey.org/experiments/xmlhttprequest-leak.html
http://diveintogreasemonkey.org/experiments/localfile-leak.html