Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2009-2654
HistoryAug 03, 2009 - 2:30 p.m.

CVE-2009-2654

2009-08-0314:30:00
CWE-20
[email protected]
web.nvd.nist.gov
55
cve-2009-2654
mozilla firefox
address bar spoofing
phishing
nvd

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

5.7 Medium

AI Score

Confidence

High

0.031 Low

EPSS

Percentile

91.2%

JSON

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.

Affected configurations

NVD
Node
mozillafirefoxRange≤3.5.1
OR
mozillafirefoxMatch0.1
OR
mozillafirefoxMatch0.2
OR
mozillafirefoxMatch0.3
OR
mozillafirefoxMatch0.4
OR
mozillafirefoxMatch0.5
OR
mozillafirefoxMatch0.6
OR
mozillafirefoxMatch0.6.1
OR
mozillafirefoxMatch0.7
OR
mozillafirefoxMatch0.7.1
OR
mozillafirefoxMatch0.8
OR
mozillafirefoxMatch0.9
OR
mozillafirefoxMatch0.9rc
OR
mozillafirefoxMatch0.9.1
OR
mozillafirefoxMatch0.9.2
OR
mozillafirefoxMatch0.9.3
OR
mozillafirefoxMatch0.9_rc
OR
mozillafirefoxMatch0.10
OR
mozillafirefoxMatch0.10.1
OR
mozillafirefoxMatch1.0
OR
mozillafirefoxMatch1.0preview_release
OR
mozillafirefoxMatch1.0.1
OR
mozillafirefoxMatch1.0.2
OR
mozillafirefoxMatch1.0.3
OR
mozillafirefoxMatch1.0.4
OR
mozillafirefoxMatch1.0.5
OR
mozillafirefoxMatch1.0.6
OR
mozillafirefoxMatch1.0.7
OR
mozillafirefoxMatch1.0.8
OR
mozillafirefoxMatch1.4.1
OR
mozillafirefoxMatch1.5
OR
mozillafirefoxMatch1.5beta1
OR
mozillafirefoxMatch1.5beta2
OR
mozillafirefoxMatch1.5.0.1
OR
mozillafirefoxMatch1.5.0.2
OR
mozillafirefoxMatch1.5.0.3
OR
mozillafirefoxMatch1.5.0.4
OR
mozillafirefoxMatch1.5.0.5
OR
mozillafirefoxMatch1.5.0.6
OR
mozillafirefoxMatch1.5.0.7
OR
mozillafirefoxMatch1.5.0.8
OR
mozillafirefoxMatch1.5.0.9
OR
mozillafirefoxMatch1.5.0.10
OR
mozillafirefoxMatch1.5.0.11
OR
mozillafirefoxMatch1.5.0.12
OR
mozillafirefoxMatch1.5.1
OR
mozillafirefoxMatch1.5.2
OR
mozillafirefoxMatch1.5.3
OR
mozillafirefoxMatch1.5.4
OR
mozillafirefoxMatch1.5.5
OR
mozillafirefoxMatch1.5.6
OR
mozillafirefoxMatch1.5.7
OR
mozillafirefoxMatch1.5.8
OR
mozillafirefoxMatch1.8
OR
mozillafirefoxMatch2.0
OR
mozillafirefoxMatch2.0beta_1
OR
mozillafirefoxMatch2.0beta1
OR
mozillafirefoxMatch2.0rc2
OR
mozillafirefoxMatch2.0rc3
OR
mozillafirefoxMatch2.0.0.1
OR
mozillafirefoxMatch2.0.0.2
OR
mozillafirefoxMatch2.0.0.3
OR
mozillafirefoxMatch2.0.0.4
OR
mozillafirefoxMatch2.0.0.5
OR
mozillafirefoxMatch2.0.0.6
OR
mozillafirefoxMatch2.0.0.7
OR
mozillafirefoxMatch2.0.0.8
OR
mozillafirefoxMatch2.0.0.9
OR
mozillafirefoxMatch2.0.0.10
OR
mozillafirefoxMatch2.0.0.11
OR
mozillafirefoxMatch2.0.0.12
OR
mozillafirefoxMatch2.0.0.13
OR
mozillafirefoxMatch2.0.0.14
OR
mozillafirefoxMatch2.0.0.15
OR
mozillafirefoxMatch2.0.0.16
OR
mozillafirefoxMatch2.0.0.17
OR
mozillafirefoxMatch2.0.0.18
OR
mozillafirefoxMatch2.0.0.19
OR
mozillafirefoxMatch2.0.0.20
OR
mozillafirefoxMatch2.0.0.21
OR
mozillafirefoxMatch2.0_.1
OR
mozillafirefoxMatch2.0_.4
OR
mozillafirefoxMatch2.0_.5
OR
mozillafirefoxMatch2.0_.6
OR
mozillafirefoxMatch2.0_.7
OR
mozillafirefoxMatch2.0_.9
OR
mozillafirefoxMatch2.0_.10
OR
mozillafirefoxMatch2.0_8
OR
mozillafirefoxMatch3.0
OR
mozillafirefoxMatch3.0beta2
OR
mozillafirefoxMatch3.0beta5
OR
mozillafirefoxMatch3.0.1
OR
mozillafirefoxMatch3.0.2
OR
mozillafirefoxMatch3.0.3
OR
mozillafirefoxMatch3.0.4
OR
mozillafirefoxMatch3.0.5
OR
mozillafirefoxMatch3.0.6
OR
mozillafirefoxMatch3.0.7
OR
mozillafirefoxMatch3.0.8
OR
mozillafirefoxMatch3.0.9
OR
mozillafirefoxMatch3.0.10
OR
mozillafirefoxMatch3.0.11
OR
mozillafirefoxMatch3.0.12
OR
mozillafirefoxMatch3.1beta1
OR
mozillafirefoxMatch3.2beta1
OR
mozillafirefoxMatch3.2beta2
OR
mozillafirefoxMatch3.2beta3
OR
mozillafirefoxMatch3.5

References

Related

openvas 44
prion 2
veracode 1
ubuntucve 2
mozilla 1
debian 1
securityvulns 2
ubuntu 1
nvd 2
nessus 26
cvelist 2
cve 1
osv 1
oraclelinux 2
redhat 3
centos 3
suse 1
gentoo 1
openvas
openvas
Ubuntu USN-811-1 (xulrunner-1.9)
2009-08-17 00:00:00
Ubuntu: Security Advisory (USN-811-1)
2009-08-17 00:00:00
Debian Security Advisory DSA 1873-1 (xulrunner)
2009-09-02 00:00:00
prion
prion
Design/Logic Flaw
2009-08-03 14:30:00
Design/Logic Flaw
2009-12-17 17:30:00
veracode
veracode
Spoofable Address Bar
2020-04-10 00:37:55
ubuntucve
ubuntucve
CVE-2009-2654
2009-08-03 00:00:00
CVE-2009-3985
2009-12-15 00:00:00
mozilla
mozilla
Location bar and SSL indicator spoofing via window.open() on invalid URL — Mozilla
2009-08-03 00:00:00
debian
debian
[SECURITY] [DSA 1873-1] New xulrunner packages fix spoofing vulnerabilities
2009-08-26 18:51:42
securityvulns
securityvulns
Mozilla Foundation Security Advisory 2009-44
2009-08-07 00:00:00
Mozilla Firefox, Thunderbird, SeaMonkey, NSS multiple security vulnerabilities
2009-08-07 00:00:00
ubuntu
ubuntu
Firefox and Xulrunner vulnerability
2009-08-08 00:00:00
nvd
nvd
CVE-2009-2654
2009-08-03 14:30:00
CVE-2009-3985
2009-12-17 17:30:00
nessus
nessus
Debian DSA-1873-1 : xulrunner - programming error
2010-02-24 00:00:00
Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerability (USN-811-1)
2009-08-05 00:00:00
Mandriva Linux Security Advisory : firefox (MDVSA-2009:198)
2009-08-10 00:00:00
cvelist
cvelist
CVE-2009-2654
2009-08-03 14:00:00
CVE-2009-3985
2009-12-17 17:00:00
cve
cve
CVE-2009-3985
2009-12-17 17:30:00
osv
osv
xulrunner - spoofing vulnerabilities
2009-08-26 00:00:00
oraclelinux
oraclelinux
seamonkey security update
2009-09-10 00:00:00
firefox security update
2009-09-10 00:00:00
redhat
redhat
(RHSA-2009:1431) Critical: seamonkey security update
2009-09-09 00:00:00
(RHSA-2009:1432) Critical: seamonkey security update
2009-09-09 00:00:00
(RHSA-2009:1430) Critical: firefox security update
2009-09-09 00:00:00
centos
centos
seamonkey security update
2009-09-10 22:51:03
seamonkey security update
2009-09-10 11:03:30
firefox, nspr, xulrunner security update
2009-09-10 22:47:20
suse
suse
remote code execution in MozillaFirefox
2009-10-20 17:59:46
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2013-01-08 00:00:00

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

5.7 Medium

AI Score

Confidence

High

0.031 Low

EPSS

Percentile

91.2%

JSON
Related for CVE-2009-2654
openvas44prion2veracode1ubuntucve2mozilla1debian1securityvulns2ubuntu1nvd2nessus26cvelist2cve1osv1oraclelinux2redhat3centos3suse1gentoo1