CVE-2008-7220 in the critical feed json
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests…
published 2009-09-13 17 y ago modified 2026-06-16 4 mo ago also EUVD-2008-7179
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.4%
- EPSS 13.4% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.
Patch / fix
- prototypejs prototype 1.6.0.2
- exaile Debian 14, Debian 13 0.2.14+debian-2.2
- symfony Debian 14, Debian 13, Debian 12 1.0.21-1.1
- asterisk Debian 14 1:1.6.2.0~rc3-1
- wordpress Debian 14, Debian 13, Debian 12 2.5.0-2
- jscropperui Debian 14, Debian 13, Debian 12 1.2.1-1
- prototypejs Debian 14, Debian 13, Debian 12 1.6.0.2-1
- scriptaculous Debian 14, Debian 13, Debian 12 1.8.3-1
- libhtml-prototype-perl Debian 14, Debian 13, Debian 12 1.48-3
debian advisories DEBIAN-CVE-2008-7220
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2008-7220 updated cvss 4.3
FrameWork: XSS Ajax requests (AST-2009-009)
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
13.36% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
bugzilla.redhat.com
/show_bug.cgi?id=523277
issue-tracking, patch, third-party-advisory
-
redhat.com
/archives/fedora-package-announce/2009-November/msg00838.html
vendor-advisory, broken-link
-
debian.org
/security/2009/dsa-1952
vendor-advisory, third-party-advisory
-
redhat.com
/archives/fedora-package-announce/2009-November/msg00789.html
vendor-advisory, broken-link
-
secunia.com
/advisories/37479
third-party-advisory
-
osvdb.org
/46312
vdb-entry, broken-link
-
secunia.com
/advisories/37677
third-party-advisory
-
github.com
/sstephenson/prototype/blob/master/CHANGELOG
release-notes, third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=533137
issue-tracking, not-applicable, third-party-advisory
-
openwall.com
/lists/oss-security/2009/11/07/2
mailing-list, third-party-advisory
-
seclists.org
/bugtraq/2019/May/18
mailing-list, issue-tracking, third-party-advisory
-
packetstormsecurity.com
/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
third-party-advisory, vdb-entry
-
seclists.org
/fulldisclosure/2019/May/11
mailing-list, third-party-advisory
-
seclists.org
/fulldisclosure/2019/May/10
mailing-list, third-party-advisory
-
seclists.org
/fulldisclosure/2019/May/13
mailing-list, third-party-advisory
-
lists.apache.org
/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b36260c1caee10b87%40%3Cnotifications.zookeeper.apache.org%
mailing-list
-
lists.apache.org
/thread.html/7ba863c5a4a0f1230cba2d11cf4de3a2eda3a42e8023d4990f564327%40%3Cdev.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/6d1b9a75a004dab42c81e8aa149d90e6fd26ce8cd6d71295e565e366%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/2ad48cd9d47edd0e677082eb869115809473a117e1e30b52fb511590%40%3Cissues.zookeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/769fcc5f331b61c4d7ce16b807678e9a1799628d0146322e14aa24ed%40%3Cdev.zookeeper.apache.org%3E
mailing-list
Sources
- CVE List CVE-2008-7220
- NVD CVE-2008-7220
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.