CVE-2008-7220
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows...
CVE-2008-7220 is a high vulnerability (CVSS 7.5) in Prototypejs Prototype, published September 13, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.4%, the 96th percentile. Fixed in asterisk 1:1.6.2.0~rc3-1.
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.
- Record
CVE-2008-7220- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.
- Record
CVE-2008-7220- Updated
- 2026-11-02
EUVDEUVD-2008-7179 No score
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.
- Record
EUVD-2008-7179- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mgmj-3x8r-9rwj No score
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows...
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.
- Record
GHSA-mgmj-3x8r-9rwj- Updated
- 2026-11-02
OSV No score
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.
- Record
CVE-2008-7220- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-7220 No score
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.
- Record
DEBIAN-CVE-2008-7220- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:1.6.2.0~rc3-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:1.6.2.0~rc3-1 |
exaileDebian:13 |
before 0.2.14+debian-2.2 | 0.2.14+debian-2.2 |
exaileDebian:14 |
before 0.2.14+debian-2.2 | 0.2.14+debian-2.2 |
jscropperuiDebian:12 |
before 1.2.1-1 | 1.2.1-1 |
jscropperuiDebian:13 |
before 1.2.1-1 | 1.2.1-1 |
jscropperuiDebian:14 |
before 1.2.1-1 | 1.2.1-1 |
libhtml-prototype-perlDebian:12 |
before 1.48-3 | 1.48-3 |
libhtml-prototype-perlDebian:13 |
before 1.48-3 | 1.48-3 |
libhtml-prototype-perlDebian:14 |
before 1.48-3 | 1.48-3 |
prototypejsDebian:12 |
before 1.6.0.2-1 | 1.6.0.2-1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
prototypejsDebian:13 |
before 1.6.0.2-1 | 1.6.0.2-1 |
prototypejsDebian:14 |
before 1.6.0.2-1 | 1.6.0.2-1 |
scriptaculousDebian:12 |
before 1.8.3-1 | 1.8.3-1 |
scriptaculousDebian:13 |
before 1.8.3-1 | 1.8.3-1 |
scriptaculousDebian:14 |
before 1.8.3-1 | 1.8.3-1 |
symfonyDebian:12 |
before 1.0.21-1.1 | 1.0.21-1.1 |
symfonyDebian:13 |
before 1.0.21-1.1 | 1.0.21-1.1 |
symfonyDebian:14 |
before 1.0.21-1.1 | 1.0.21-1.1 |
wordpressDebian:12 |
before 2.5.0-2 | 2.5.0-2 |
wordpressDebian:13 |
before 2.5.0-2 | 2.5.0-2 |
wordpressDebian:14 |
before 2.5.0-2 | 2.5.0-2 |
asteriskDebian:5.0 |
before 1:1.4.21.2~dfsg-3+lenny1, plus listed versions 1:1.4.21.2~dfsg-3 |
1:1.4.21.2~dfsg-3+lenny1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | followboy1999/CVE-2008-7220 | 2016-10-28 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
redhat.com/archives/fedora-package-announce/2009-November/msg00838.html
secunia.com/advisories/37479
osvdb.org/46312
debian.org/security/2009/dsa-1952
bugzilla.redhat.com/show_bug.cgi?id=523277
Show 22 moreShow less
github.com/sstephenson/prototype/blob/master/CHANGELOG
openwall.com/lists/oss-security/2009/11/07/2
seclists.org/bugtraq/2019/May/18
packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
lists.apache.org/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b36260c1caee10b87%40%3Cnotifications.zookeeper.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2008-7220
security-tracker.debian.org/tracker/CVE-2008-7220
Left out here: 60 versions. The JSON record has them.