CVE-2007-3484 (GCVE-0-2007-3484)

Vulnerability from cvelistv5 – Published: 2007-06-28 20:00 – Updated: 2024-08-07 14:21 Disputed
VLAI
Summary
Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this issue is disputed by the Google Security Team, who states that "Google does not provide the 'search.php' script referenced. When a user creates a custom search engine, we provide them with a block of javascript to include on their site. Some users write additional code around this block of javascript to further customize their website.
Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • n/a
Assigner
References
URL Tags
http://osvdb.org/38038 vdb-entryx_refsource_OSVDB
http://www.attrition.org/pipermail/vim/2007-July/… mailing-listx_refsource_VIM
http://websecurity.com.ua/1050/ x_refsource_MISC
Date Public
2007-06-15 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2007-3484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T19:33:37.182425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:43:01.374Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "ADP Container"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:21:36.414Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "38038",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/38038"
          },
          {
            "name": "20070710 Vendor dispute - Google Custom Search Engine XSS (CVE-2007-3484)",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-July/001706.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://websecurity.com.ua/1050/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-06-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter.  NOTE: this issue is disputed by the Google Security Team, who states that \"Google does not provide the \u0027search.php\u0027 script referenced.  When a user creates a custom search engine, we provide them with a block of javascript to include on their site.  Some users write additional code around this block of javascript to further customize their website."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2007-07-11T09:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "38038",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/38038"
        },
        {
          "name": "20070710 Vendor dispute - Google Custom Search Engine XSS (CVE-2007-3484)",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-July/001706.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://websecurity.com.ua/1050/"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-3484",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED **  Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter.  NOTE: this issue is disputed by the Google Security Team, who states that \"Google does not provide the \u0027search.php\u0027 script referenced.  When a user creates a custom search engine, we provide them with a block of javascript to include on their site.  Some users write additional code around this block of javascript to further customize their website.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "38038",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/38038"
            },
            {
              "name": "20070710 Vendor dispute - Google Custom Search Engine XSS (CVE-2007-3484)",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-July/001706.html"
            },
            {
              "name": "http://websecurity.com.ua/1050/",
              "refsource": "MISC",
              "url": "http://websecurity.com.ua/1050/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-3484",
    "datePublished": "2007-06-28T20:00:00.000Z",
    "dateReserved": "2007-06-28T00:00:00.000Z",
    "dateUpdated": "2024-08-07T14:21:36.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2007-3484",
      "date": "2026-07-29",
      "epss": "0.0044",
      "percentile": "0.36092"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2007-3484\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2007-06-28T20:30:00.000\",\"lastModified\":\"2026-04-23T00:35:47.467\",\"vulnStatus\":\"Modified\",\"cveTags\":[{\"sourceIdentifier\":\"cve@mitre.org\",\"tags\":[\"disputed\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter.  NOTE: this issue is disputed by the Google Security Team, who states that \\\"Google does not provide the \u0027search.php\u0027 script referenced.  When a user creates a custom search engine, we provide them with a block of javascript to include on their site.  Some users write additional code around this block of javascript to further customize their website.\"},{\"lang\":\"es\",\"value\":\"** EN DISPUTA ** La vulnerabilidad de secuencias de comandos entre sitios (XSS) en search.php en Google Custom Search Engine permite a los atacantes remotos inyectar scripts web arbitrarios o HTML a trav\u00e9s del par\u00e1metro q. NOTA: este problema es cuestionado por el equipo de seguridad de Google, que afirma que \\\"Google no proporciona el script \u0027search.php\u0027 al que se hace referencia. Cuando un usuario crea un motor de b\u00fasqueda personalizado, le proporcionamos un bloque de javascript para incluir en su sitio. Algunos usuarios escriben c\u00f3digo adicional alrededor de este bloque de javascript para personalizar a\u00fan m\u00e1s su sitio web.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:google:custom_search_engine:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"516F88E2-68DA-402D-8115-7CEB495B4D01\"}]}]}],\"references\":[{\"url\":\"http://osvdb.org/38038\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://websecurity.com.ua/1050/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.attrition.org/pipermail/vim/2007-July/001706.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/38038\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://websecurity.com.ua/1050/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.attrition.org/pipermail/vim/2007-July/001706.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://osvdb.org/38038\", \"name\": \"38038\", \"tags\": [\"vdb-entry\", \"x_refsource_OSVDB\", \"x_transferred\"]}, {\"url\": \"http://www.attrition.org/pipermail/vim/2007-July/001706.html\", \"name\": \"20070710 Vendor dispute - Google Custom Search Engine XSS (CVE-2007-3484)\", \"tags\": [\"mailing-list\", \"x_refsource_VIM\", \"x_transferred\"]}, {\"url\": \"http://websecurity.com.ua/1050/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-07T14:21:36.414Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2007-3484\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-24T19:33:37.182425Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-24T19:33:26.587Z\"}}], \"cna\": {\"tags\": [\"disputed\"], \"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2007-06-15T04:00:00.000Z\", \"references\": [{\"url\": \"http://osvdb.org/38038\", \"name\": \"38038\", \"tags\": [\"vdb-entry\", \"x_refsource_OSVDB\"]}, {\"url\": \"http://www.attrition.org/pipermail/vim/2007-July/001706.html\", \"name\": \"20070710 Vendor dispute - Google Custom Search Engine XSS (CVE-2007-3484)\", \"tags\": [\"mailing-list\", \"x_refsource_VIM\"]}, {\"url\": \"http://websecurity.com.ua/1050/\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter.  NOTE: this issue is disputed by the Google Security Team, who states that \\\"Google does not provide the \u0027search.php\u0027 script referenced.  When a user creates a custom search engine, we provide them with a block of javascript to include on their site.  Some users write additional code around this block of javascript to further customize their website.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2007-07-11T13:00:00.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}, \"product_name\": \"n/a\"}]}, \"vendor_name\": \"n/a\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"http://osvdb.org/38038\", \"name\": \"38038\", \"refsource\": \"OSVDB\"}, {\"url\": \"http://www.attrition.org/pipermail/vim/2007-July/001706.html\", \"name\": \"20070710 Vendor dispute - Google Custom Search Engine XSS (CVE-2007-3484)\", \"refsource\": \"VIM\"}, {\"url\": \"http://websecurity.com.ua/1050/\", \"name\": \"http://websecurity.com.ua/1050/\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"** DISPUTED **  Cross-site scripting (XSS) vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter.  NOTE: this issue is disputed by the Google Security Team, who states that \\\"Google does not provide the \u0027search.php\u0027 script referenced.  When a user creates a custom search engine, we provide them with a block of javascript to include on their site.  Some users write additional code around this block of javascript to further customize their website.\\\"\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2007-3484\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"cve@mitre.org\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2007-3484\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-07T14:21:36.414Z\", \"dateReserved\": \"2007-06-28T04:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2007-06-29T00:00:00.000Z\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.