Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2009-2065
HistoryJun 15, 2009 - 7:30 p.m.

CVE-2009-2065

2009-06-1519:30:05
CWE-287
[email protected]
web.nvd.nist.gov
35
mozilla
firefox
security
vulnerability
man-in-the-middle
web script
https
nvd
cve-2009-2065

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.8%

JSON

Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site’s context, by modifying an http page to include an https iframe that references a script file on an http site, related to “HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages.”

Affected configurations

NVD
Node
mozillafirefoxRange≤3.0.9
OR
mozillafirefoxMatch0.1
OR
mozillafirefoxMatch0.2
OR
mozillafirefoxMatch0.3
OR
mozillafirefoxMatch0.4
OR
mozillafirefoxMatch0.5
OR
mozillafirefoxMatch0.6
OR
mozillafirefoxMatch0.6.1
OR
mozillafirefoxMatch0.7
OR
mozillafirefoxMatch0.7.1
OR
mozillafirefoxMatch0.8
OR
mozillafirefoxMatch0.9
OR
mozillafirefoxMatch0.9rc
OR
mozillafirefoxMatch0.9.1
OR
mozillafirefoxMatch0.9.2
OR
mozillafirefoxMatch0.9.3
OR
mozillafirefoxMatch0.9_rc
OR
mozillafirefoxMatch0.10
OR
mozillafirefoxMatch0.10.1
OR
mozillafirefoxMatch1.0
OR
mozillafirefoxMatch1.0preview_release
OR
mozillafirefoxMatch1.0.1
OR
mozillafirefoxMatch1.0.2
OR
mozillafirefoxMatch1.0.3
OR
mozillafirefoxMatch1.0.4
OR
mozillafirefoxMatch1.0.5
OR
mozillafirefoxMatch1.0.6
OR
mozillafirefoxMatch1.0.7
OR
mozillafirefoxMatch1.0.8
OR
mozillafirefoxMatch1.4.1
OR
mozillafirefoxMatch1.5
OR
mozillafirefoxMatch1.5beta1
OR
mozillafirefoxMatch1.5beta2
OR
mozillafirefoxMatch1.5.0.1
OR
mozillafirefoxMatch1.5.0.2
OR
mozillafirefoxMatch1.5.0.3
OR
mozillafirefoxMatch1.5.0.4
OR
mozillafirefoxMatch1.5.0.5
OR
mozillafirefoxMatch1.5.0.6
OR
mozillafirefoxMatch1.5.0.7
OR
mozillafirefoxMatch1.5.0.8
OR
mozillafirefoxMatch1.5.0.9
OR
mozillafirefoxMatch1.5.0.10
OR
mozillafirefoxMatch1.5.0.11
OR
mozillafirefoxMatch1.5.0.12
OR
mozillafirefoxMatch1.5.1
OR
mozillafirefoxMatch1.5.2
OR
mozillafirefoxMatch1.5.3
OR
mozillafirefoxMatch1.5.4
OR
mozillafirefoxMatch1.5.6
OR
mozillafirefoxMatch1.5.7
OR
mozillafirefoxMatch1.5.8
OR
mozillafirefoxMatch1.8
OR
mozillafirefoxMatch2.0
OR
mozillafirefoxMatch2.0beta_1
OR
mozillafirefoxMatch2.0beta1
OR
mozillafirefoxMatch2.0rc3
OR
mozillafirefoxMatch2.0.0.3
OR
mozillafirefoxMatch2.0.0.5
OR
mozillafirefoxMatch2.0.0.7
OR
mozillafirefoxMatch2.0.0.8
OR
mozillafirefoxMatch2.0.0.9
OR
mozillafirefoxMatch2.0.0.10
OR
mozillafirefoxMatch2.0.0.11
OR
mozillafirefoxMatch2.0.0.13
OR
mozillafirefoxMatch2.0.0.14
OR
mozillafirefoxMatch2.0.0.16
OR
mozillafirefoxMatch2.0.0.17
OR
mozillafirefoxMatch2.0.0.18
OR
mozillafirefoxMatch2.0.0.19
OR
mozillafirefoxMatch2.0.0.20
OR
mozillafirefoxMatch2.0.0.21
OR
mozillafirefoxMatch2.0_.1
OR
mozillafirefoxMatch2.0_.4
OR
mozillafirefoxMatch2.0_.6
OR
mozillafirefoxMatch2.0_.9
OR
mozillafirefoxMatch2.0_.10
OR
mozillafirefoxMatch2.0_8
OR
mozillafirefoxMatch3.0
OR
mozillafirefoxMatch3.0.2
OR
mozillafirefoxMatch3.0.3
OR
mozillafirefoxMatch3.0.4
OR
mozillafirefoxMatch3.0.5
OR
mozillafirefoxMatch3.0.6
OR
mozillafirefoxMatch3.0.7
OR
mozillafirefoxMatch3.0.10

Related

ubuntucve 1
prion 1
cvelist 1
nvd 1
seebug 1
openvas 9
nessus 2
gentoo 1
ubuntucve
ubuntucve
CVE-2009-2065
2009-06-15 00:00:00
prion
prion
Design/Logic Flaw
2009-06-15 19:30:00
cvelist
cvelist
CVE-2009-2065
2009-06-15 19:00:00
nvd
nvd
CVE-2009-2065
2009-06-15 19:30:05
seebug
seebug
多个浏览器HTTPS内容上下文中的HTTP资源安全绕过漏洞
2009-06-22 00:00:00
openvas
openvas
Mozilla Firefox Multiple Vulnerabilities (Jun 2009) - Windows
2009-06-16 00:00:00
Mozilla Firefox Multiple Vulnerability Jun-09 (Windows)
2009-06-16 00:00:00
Mandrake Security Advisory MDVSA-2009:134 (firefox)
2009-06-23 00:00:00
nessus
nessus
Mandriva Linux Security Advisory : firefox (MDVSA-2009:134)
2009-06-18 00:00:00
GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)
2013-01-08 00:00:00
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2013-01-08 00:00:00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.8%

JSON
Related for CVE-2009-2065
ubuntucve1prion1cvelist1nvd1seebug1openvas9nessus2gentoo1