CVE-2009-3988
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.8 Medium
AI Score
Confidence
High
0.013 Low
EPSS
Percentile
86.2%
Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.
Affected configurations
References
lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html
lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html
lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html
secunia.com/advisories/37242
secunia.com/advisories/38847
www.debian.org/security/2010/dsa-1999
www.mandriva.com/security/advisories?name=MDVSA-2010:042
www.mozilla.org/security/announce/2010/mfsa2010-04.html
www.redhat.com/support/errata/RHSA-2010-0112.html
www.ubuntu.com/usn/USN-895-1
www.ubuntu.com/usn/USN-896-1
www.vupen.com/english/advisories/2010/0405
bugzilla.mozilla.org/show_bug.cgi?id=504862
exchange.xforce.ibmcloud.com/vulnerabilities/56362
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384
Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.8 Medium
AI Score
Confidence
High
0.013 Low
EPSS
Percentile
86.2%