CVE-2007-2383
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object...
CVE-2007-2383 is a medium vulnerability (CVSS 5.0) in Prototypejs Prototype Framework, published April 30, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in asterisk 1:1.6.2.0~rc3-1.
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Exploit likelihood
What each source reports
NVD Score used
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
- Record
CVE-2007-2383- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
- Record
CVE-2007-2383- Updated
- 2026-11-02
EUVDEUVD-2007-2378 No score
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
- Record
EUVD-2007-2378- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qgq2-pf5j-2fvq No score
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object...
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
- Record
GHSA-qgq2-pf5j-2fvq- Updated
- 2026-11-02
OSV No score
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
- Record
CVE-2007-2383- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-2383 No score
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
- Record
DEBIAN-CVE-2007-2383- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:1.6.2.0~rc3-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:1.6.2.0~rc3-1 |
jscropperuiDebian:12 |
before 1.2.1-1 | 1.2.1-1 |
jscropperuiDebian:13 |
before 1.2.1-1 | 1.2.1-1 |
jscropperuiDebian:14 |
before 1.2.1-1 | 1.2.1-1 |
libhtml-prototype-perlDebian:12 |
before 1.48-3 | 1.48-3 |
libhtml-prototype-perlDebian:13 |
before 1.48-3 | 1.48-3 |
libhtml-prototype-perlDebian:14 |
before 1.48-3 | 1.48-3 |
symfonyDebian:12 |
before 1.0.21-1.1 | 1.0.21-1.1 |
symfonyDebian:13 |
before 1.0.21-1.1 | 1.0.21-1.1 |
symfonyDebian:14 |
before 1.0.21-1.1 | 1.0.21-1.1 |
asteriskDebian:5.0 |
before 1:1.4.21.2~dfsg-3+lenny1, plus listed versions 1:1.4.21.2~dfsg-3 |
1:1.4.21.2~dfsg-3+lenny1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
secunia.com/advisories/37677
fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf
debian.org/security/2009/dsa-1952
prototypejs.org/2007/4/24/release-candidate-3
dev.rubyonrails.org/ticket/7910
nvd.nist.gov/vuln/detail/CVE-2007-2383
github.com/advisories/GHSA-qgq2-pf5j-2fvq
security-tracker.debian.org/tracker/CVE-2007-2383
Left out here: 60 versions. The JSON record has them.