Vulnerability in Flock
CVE-2009-3007
Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1, allow context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker.
EPSS: 0.006 (47.1th percentile) — read the EPSS interpretation.
Affected products
- Flock — versions 2.5.1
- Mozilla Firefox — versions 3.5.1
- Mozilla Seamonkey — versions 1.1.7
- N/a — versions n/a
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_MISC)