Code injection

2011-09-1319:59:00

PRIOn knowledge base

www.prio-n.com

7.9 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.9%

JSON

Palm Pre WebOS 1.1 and earlier processes JavaScript in email messages, which allows remote attackers to execute arbitrary JavaScript, as demonstrated by reading PalmDatabase.db3.

CPENameOperatorVersion
palm_pre_weboseq1.0.3
palm_pre_weboseq1.0.4
palm_pre_weboseq1.0.2
palm_pre_webosle1.1.0

Name	Operator	Version
palm_pre_webos	eq	1.0.3
palm_pre_webos	eq	1.0.4
palm_pre_webos	eq	1.0.2
palm_pre_webos	le	1.1.0

References

kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html

secunia.com/advisories/36936

www.precentral.net/webos-1-2-fixed-serious-file-security-issue

www.securitytracker.com/id?1022987

tlhsecurity.blogspot.com/2009/10/palm-pre-webos-11-remote-file-access.html