CVE-2009-5097

2022-10-0316:24:01

mitre

www.cve.org

palm pre

webos

javascript

palmdatabase.db3

remote attackers

arbitrary execution

7.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.9%

JSON

Palm Pre WebOS 1.1 and earlier processes JavaScript in email messages, which allows remote attackers to execute arbitrary JavaScript, as demonstrated by reading PalmDatabase.db3.

References

kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#12

secunia.com/advisories/36936

tlhsecurity.blogspot.com/2009/10/palm-pre-webos-11-remote-file-access.html

www.precentral.net/webos-1-2-fixed-serious-file-security-issue

www.securitytracker.com/id?1022987