Unrated severityNVD Advisory· Published Apr 30, 2007· Updated Apr 23, 2026

CVE-2007-2377

Description

The Getahead Direct Web Remoting (DWR) framework 1.1.4 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."

Affected products

Directwebremoting/Direct Web Remoting
cpe:2.3:a:getahead:direct_web_remoting:1.1.4:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdfnvdURL Repurposed
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlnvd
osvdb.org/43322nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000