Lucene search

MitreCVE-2009-3385

HistoryMar 23, 2010 - 12:53 a.m.

CVE-2009-3385

2010-03-2300:53:22

CWE-264

mitre

web.nvd.nist.gov

cve-2009-3385

mozilla seamonkey

mail component

scriptable plugin content

remote attackers

sensitive information

html e-mail

iframe

flash object

nvd

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:C/I:N/A:N

AI Score

Confidence

Low

EPSS

0.041

Percentile

92.2%

JSON

The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as demonstrated by a Flash object that sends arbitrary local files during a reply or forward operation.

Affected configurations

Nvd

Node

mozillaseamonkeyRange≤1.1.18

mozillaseamonkeyMatch1.0

mozillaseamonkeyMatch1.0alpha

mozillaseamonkeyMatch1.0beta

mozillaseamonkeyMatch1.0.1

mozillaseamonkeyMatch1.0.2

mozillaseamonkeyMatch1.0.3

mozillaseamonkeyMatch1.0.4

mozillaseamonkeyMatch1.0.5

mozillaseamonkeyMatch1.0.6

mozillaseamonkeyMatch1.0.7

mozillaseamonkeyMatch1.0.8

mozillaseamonkeyMatch1.0.9

mozillaseamonkeyMatch1.1

mozillaseamonkeyMatch1.1alpha

mozillaseamonkeyMatch1.1beta

mozillaseamonkeyMatch1.1.1

mozillaseamonkeyMatch1.1.2

mozillaseamonkeyMatch1.1.3

mozillaseamonkeyMatch1.1.4

mozillaseamonkeyMatch1.1.5

mozillaseamonkeyMatch1.1.6

mozillaseamonkeyMatch1.1.7

mozillaseamonkeyMatch1.1.8

mozillaseamonkeyMatch1.1.9

mozillaseamonkeyMatch1.1.10

mozillaseamonkeyMatch1.1.11

mozillaseamonkeyMatch1.1.12

mozillaseamonkeyMatch1.1.13

mozillaseamonkeyMatch1.1.14

mozillaseamonkeyMatch1.1.15

mozillaseamonkeyMatch1.1.16

mozillaseamonkeyMatch1.1.17

VendorProductVersionCPE
mozillaseamonkey1.0.1cpe:/a:mozilla:seamonkey:1.0.1:::
mozillaseamonkey1.0.7cpe:/a:mozilla:seamonkey:1.0.7:::
mozillaseamonkey1.0cpe:/a:mozilla:seamonkey:1.0:alpha::
mozillaseamonkey1.0.9cpe:/a:mozilla:seamonkey:1.0.9:::
mozillaseamonkey1.0cpe:/a:mozilla:seamonkey:1.0:::
mozillaseamonkey1.1.5cpe:/a:mozilla:seamonkey:1.1.5:::
mozillaseamonkey1.1.1cpe:/a:mozilla:seamonkey:1.1.1:::
mozillaseamonkey1.1.12cpe:/a:mozilla:seamonkey:1.1.12:::
mozillaseamonkey1.1.6cpe:/a:mozilla:seamonkey:1.1.6:::
mozillaseamonkey1.1.10cpe:/a:mozilla:seamonkey:1.1.10:::

Vendor	Product	Version	CPE
mozilla	seamonkey	1.0.1	cpe:/a:mozilla:seamonkey:1.0.1:::
mozilla	seamonkey	1.0.7	cpe:/a:mozilla:seamonkey:1.0.7:::
mozilla	seamonkey	1.0	cpe:/a:mozilla:seamonkey:1.0:alpha::
mozilla	seamonkey	1.0.9	cpe:/a:mozilla:seamonkey:1.0.9:::
mozilla	seamonkey	1.0	cpe:/a:mozilla:seamonkey:1.0:::
mozilla	seamonkey	1.1.5	cpe:/a:mozilla:seamonkey:1.1.5:::
mozilla	seamonkey	1.1.1	cpe:/a:mozilla:seamonkey:1.1.1:::
mozilla	seamonkey	1.1.12	cpe:/a:mozilla:seamonkey:1.1.12:::
mozilla	seamonkey	1.1.6	cpe:/a:mozilla:seamonkey:1.1.6:::
mozilla	seamonkey	1.1.10	cpe:/a:mozilla:seamonkey:1.1.10:::