| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 7.9 | $0-$5k | 0.00 |
Summary
A vulnerability labeled as problematic has been found in Google Desktop. Affected by this vulnerability is an unknown functionality of the file google.com. The manipulation of the argument under results in cross site scripting. This vulnerability was named CVE-2007-1085. The attack may be performed from remote. In addition, an exploit is available. The affected component should be upgraded.
Details
A vulnerability was found in Google Desktop (the affected version unknown). It has been classified as critical. Affected is an unknown part of the file google.com. The manipulation of the argument under with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web script or HTML, and possibly gain full access to the system, by using an XSS vulnerability in google.com to extract the signature for the internal web server, then calling the "under" parameter in Advanced Search with the proper signature.
The bug was discovered 02/21/2007. The weakness was presented 02/21/2007 by Danny with Opera as confirmed advisory (CERT.org). The advisory is available at kb.cert.org. This vulnerability is traded as CVE-2007-1085 since 02/22/2007. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details and a public exploit are known. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.
The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 24710 (Google Desktop Advanced Search Internal Web Server XSS), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 38575 (Google Desktop Cross-Site Scripting Weakness).
Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (32735), Exploit-DB (29623), Tenable (24710), SecurityFocus (BID 22650†) and OSVDB (33483†). If you want to get best quality of vulnerability data, you may have to visit VulDB.
Product
Vendor
Name
License
Website
- Vendor: https://www.google.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.8VulDB Meta Temp Score: 7.9
VulDB Base Score: 8.8
VulDB Temp Score: 7.9
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Cross site scriptingCWE: CWE-80 / CWE-74 / CWE-707
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Nessus ID: 24710
Nessus Name: Google Desktop Advanced Search Internal Web Server XSS
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Exploit-DB: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Timeline
02/21/2007 🔍02/21/2007 🔍
02/21/2007 🔍
02/21/2007 🔍
02/21/2007 🔍
02/21/2007 🔍
02/22/2007 🔍
02/22/2007 🔍
02/22/2007 🔍
02/26/2007 🔍
02/26/2007 🔍
03/13/2015 🔍
06/09/2025 🔍
Sources
Vendor: google.comAdvisory: kb.cert.org
Researcher: Danny
Organization: Opera
Status: Confirmed
CVE: CVE-2007-1085 (🔍)
GCVE (CVE): GCVE-0-2007-1085
GCVE (VulDB): GCVE-100-35178
CERT: 🔍
X-Force: 32735
SecurityFocus: 22650 - Google Desktop Cross-Site Scripting Weakness
OSVDB: 33483 - Google Desktop Advanced Search Internal Web Server XSS
SecurityTracker: 1017686
Vulnerability Center: 14375 - Google Desktop XSS via the \, Low
scip Labs: https://www.scip.ch/en/?labs.20161013
Entry
Created: 03/13/2015 12:16Updated: 06/09/2025 09:55
Changes: 03/13/2015 12:16 (74), 07/15/2019 11:20 (3), 10/26/2024 15:04 (25), 01/12/2025 19:06 (1), 06/09/2025 09:55 (2)
Complete: 🔍
Cache ID: 216::103
If you want to get best quality of vulnerability data, you may have to visit VulDB.
No comments yet. Languages: en.
Please log in to comment.