Secunia

Aviv Raff has reported a vulnerability in Maxthon, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a design error where the security ID of a plug-in is not properly protected from being included and accessed on an external website via the script tag. This can e.g. be exploited to read and write arbitrary files via the "readFile()" and "writeFile()" API functions via directory traversal attacks.

The vulnerability has been reported in version 1.2.0 and 1.2.1. Prior versions may also be affected.

Solution
Update to version 1.2.2.
Further details available in Customer Area

Provided and/or discovered by
Aviv Raff

Changelog
Further details available in Customer Area

Original Advisory
http://www.raffon.net/advisories/maxthon/multvulns.html

Deep Links
Links available in Customer Area