Lucene search

K
mozillaMozilla FoundationMFSA2012-03
HistoryJan 31, 2012 - 12:00 a.m.

<iframe> element exposed across domains via name attribute — Mozilla

2012-01-3100:00:00
Mozilla Foundation
www.mozilla.org
17

9.2 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.012 Low

EPSS

Percentile

84.7%

Vitaly Nevgen reported that an attacker could replace a sub-frame in another domain’s document by using the name attribute of the sub-frame as a form submission target. This can potentially allow for phishing attacks against users and violates the HTML5 frame navigation policy.

CPENameOperatorVersion
firefoxlt10
seamonkeylt2.7
thunderbirdlt10

9.2 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.012 Low

EPSS

Percentile

84.7%