CVE-2005-0145

2005-01-2905:00:00

[email protected]

web.nvd.nist.gov

124

firefox

cve-2005-0145

click event

javascript

file download prompt

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.465 Medium

EPSS

Percentile

97.5%

JSON

Firefox before 1.0 does not properly distinguish between user-generated and synthetic click events, which allows remote attackers to use Javascript to bypass the file download prompt when the user uses the Alt-click feature.

Affected configurations

NVD

Node

mozillafirefoxMatch0.8

mozillafirefoxMatch0.9

mozillafirefoxMatch0.9rc

mozillafirefoxMatch0.9.1

mozillafirefoxMatch0.9.2

mozillafirefoxMatch0.9.3

mozillafirefoxMatch0.10

mozillafirefoxMatch0.10.1

mozillafirefoxMatch1.0

CPENameOperatorVersion
mozilla:firefoxmozilla firefoxeq0.8
mozilla:firefoxmozilla firefoxeq0.9
mozilla:firefoxmozilla firefoxeq0.9.1
mozilla:firefoxmozilla firefoxeq0.9.2
mozilla:firefoxmozilla firefoxeq0.9.3
mozilla:firefoxmozilla firefoxeq0.10
mozilla:firefoxmozilla firefoxeq0.10.1
mozilla:firefoxmozilla firefoxeq1.0

CPE	Name	Operator	Version
mozilla:firefox	mozilla firefox	eq	0.8
mozilla:firefox	mozilla firefox	eq	0.9
mozilla:firefox	mozilla firefox	eq	0.9.1
mozilla:firefox	mozilla firefox	eq	0.9.2
mozilla:firefox	mozilla firefox	eq	0.9.3
mozilla:firefox	mozilla firefox	eq	0.10
mozilla:firefox	mozilla firefox	eq	0.10.1
mozilla:firefox	mozilla firefox	eq	1.0