Description
Greasemonkey before 0.3.5 allows remote web servers to (1) read arbitrary files via a GET request to a file:// URL in the GM_xmlhttpRequest API function, (2) list installed scripts using GM_scripts, or obtain sensitive information via (3) GM_setValue and GM_getValue.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Mark Pilgrim · textwebappscgi
https://www.exploit-db.com/exploits/26017
References (11)
Core 11
Core References
Patch x_refsource_confirm
http://greasemonkey.mozdev.org/changes/0.3.5.html
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/16128
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2005/1147
Various Sources mailing-list
x_refsource_mlist
http://mozdev.org/pipermail/greasemonkey/2005-July/004022.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/21453
Patch x_refsource_confirm
http://greaseblog.blogspot.com/2005/07/mandatory-greasemonkey-update.html
Exploit mailing-list
x_refsource_mlist
http://mozdev.org/pipermail/greasemonkey/2005-July/004000.html
Exploit, Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/14336
Exploit, Patch vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1014529
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/18154
Exploit, Patch x_refsource_misc
http://www.securiteam.com/securitynews/5CP0P20GBK.html
Scores
EPSS
0.0854
EPSS Percentile
92.5%
Details
Status
published
Products (1)
greasemonkey/greasemonkey
0.3.3
Published
Aug 04, 2005
Tracked Since
Feb 18, 2026