Vulnerability in Mozilla Firefox
CVE-2009-1309
Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involving an incorrect __proto__ scope, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via a crafted document.
EPSS: 0.014 (68.7th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox — versions 0.1, 0.2, 0.3
- Mozilla Seamonkey
- Mozilla Thunderbird
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
- secalert@redhat.com (vdb-entry, x_refsource_VUPEN)
- secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
- secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
- secalert@redhat.com (signature, x_refsource_OVAL, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (signature, x_refsource_OVAL, vdb-entry)