CVE-2010-2809
Published Aug 19, 2010
Last updated 7 years ago
Overview
- Description
- The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an HTML document.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 6.8
- Impact score
- 6.4
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-94
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:uzbl:uzbl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B38AB35C-E1F8-4DCF-809B-6B7179BBBB51",
"versionEndIncluding": "2010.04.03"
},
{
"criteria": "cpe:2.3:a:uzbl:uzbl:2009.12.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D110254-74B7-420F-BB3D-2D99C4F967BB"
},
{
"criteria": "cpe:2.3:a:uzbl:uzbl:2010.01.04:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0AD9D384-B346-4457-8256-B93F32047489"
}
],
"operator": "OR"
}
]
}
]