Unrated severityNVD Advisory· Published Apr 30, 2007· Updated Jun 16, 2026

CVE-2007-2383

Description

The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Prototypejs/Prototype Framework
cpe:2.3:a:prototypejs:prototype_framework:1.5.1_rc3:*:*:*:*:*:*:*
Prototypejs/Prototypellm-fuzzy
Range: <1.5.1-RC3

Patches

Vulnerability mechanics

References

www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdfnvdURL Repurposed
dev.rubyonrails.org/ticket/7910nvd
prototypejs.org/2007/4/24/release-candidate-3nvd
secunia.com/advisories/37677nvd
www.debian.org/security/2009/dsa-1952nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000