Lucene search

Mozilla FoundationMFSA2013-10

HistoryJan 08, 2013 - 12:00 a.m.

Event manipulation in plugin handler to bypass same-origin policy — Mozilla

2013-01-0800:00:00

Mozilla Foundation

www.mozilla.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

87.1%

JSON

Mozilla security researcher Jesse Ruderman reported that events in the plugin handler can be manipulated by web content to bypass same-origin policy (SOP) restrictions. This can allow for clickjacking on malicious web pages.

Affected configurations

Vulners

Node

mozillafirefoxRange<18

mozillafirefox_esrRange<17.0.2

mozillaseamonkeyRange<2.15

mozillathunderbirdRange<17.0.2

mozillathunderbird_esrRange<17.0.2

CPENameOperatorVersion
firefoxlt18
firefox esrlt17.0.2
seamonkeylt2.15
thunderbirdlt17.0.2
thunderbird esrlt17.0.2

Name	Operator	Version
firefox	lt	18
firefox esr	lt	17.0.2
seamonkey	lt	2.15
thunderbird	lt	17.0.2
thunderbird esr	lt	17.0.2

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0747

bugzilla.mozilla.org/show_bug.cgi?id=733305

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

87.1%

JSON

Related for MFSA2013-10