{
  "schema_version": "1.4.0",
  "id": "GHSA-x762-4qp9-3j6g",
  "modified": "2022-05-02T03:26:41Z",
  "published": "2022-05-02T03:26:41Z",
  "aliases": [
    "CVE-2009-1600"
  ],
  "details": "Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI.  NOTE: the researcher reports that Adobe's position is \"a PDF file is active content.\"",
  "severity": [],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1600"
    },
    {
      "type": "WEB",
      "url": "http://secniche.org/papers/SNS_09_03_PDF_Silent_Form_Re_Purp_Attack.pdf"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/503183/100/0/threaded"
    }
  ],
  "database_specific": {
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-05-11T15:30:00Z"
  }
}