CVE-2007-0044

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 56.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-01-03 · updated 2026-06-16
Weakness: CWE-352

Description

Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."

Affected products

Adobe Acrobat for Edge: through 7.0.8; 7.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5 (+3)
Adobe Acrobat 3D: all versions
Adobe Acrobat Reader: through 7.0.8; 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5 (+9)

References

http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
http://secunia.com/advisories/23812
http://secunia.com/advisories/23882
http://secunia.com/advisories/29065
http://security.gentoo.org/glsa/glsa-200701-16.xml
http://securityreason.com/securityalert/2090
http://securitytracker.com/id?1017469
http://www.redhat.com/support/errata/RHSA-2008-0144.html
http://www.securityfocus.com/archive/1/455801/100/0/threaded
http://www.securityfocus.com/bid/21858
http://www.vupen.com/english/advisories/2007/0032

Get alerted when CVE-2007-0044 or the next vulnerability affects your stack