CVE-2008-7220

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-09-13 · updated 2026-06-16

Description

Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.

Affected products

Debian Linux: 5.0, 6.0
Prototypejs Prototype: before 1.6.0.2 — fixed in 1.6.0.2

How to fix

Upgrade to a fixed version: Prototypejs Prototype 1.6.0.2. Check the vendor advisory for mitigations.

References

http://github.com/sstephenson/prototype/blob/master/CHANGELOG
http://osvdb.org/46312
http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
http://seclists.org/fulldisclosure/2019/May/10
http://seclists.org/fulldisclosure/2019/May/11
http://seclists.org/fulldisclosure/2019/May/13
http://secunia.com/advisories/37479
http://secunia.com/advisories/37677
http://www.debian.org/security/2009/dsa-1952
http://www.openwall.com/lists/oss-security/2009/11/07/2
https://bugzilla.redhat.com/show_bug.cgi?id=523277
https://bugzilla.redhat.com/show_bug.cgi?id=533137

Get alerted when CVE-2008-7220 or the next vulnerability affects your stack