Lucene search

Mozilla FoundationMFSA2012-103

HistoryNov 20, 2012 - 12:00 a.m.

Frames can shadow top.location — Mozilla

2012-11-2000:00:00

Mozilla Foundation

www.mozilla.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

57.9%

JSON

Security researcher Mariusz Mlynski reported that the location property can be accessed by binary plugins through top.location with a frame whose name attribute’s value is set to “top”. This can allow for possible cross-site scripting (XSS) attacks through plugins.

Affected configurations

Vulners

Node

mozillafirefoxRange<17

mozillafirefox_esrRange<10.0.11

mozillaseamonkeyRange<2.14

mozillathunderbirdRange<17

mozillathunderbird_esrRange<10.0.11

CPENameOperatorVersion
firefoxlt17
firefox esrlt10.0.11
seamonkeylt2.14
thunderbirdlt17
thunderbird esrlt10.0.11

Name	Operator	Version
firefox	lt	17
firefox esr	lt	10.0.11
seamonkey	lt	2.14
thunderbird	lt	17
thunderbird esr	lt	10.0.11

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4209

bugzilla.mozilla.org/show_bug.cgi?id=792405

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

57.9%

JSON

Related for MFSA2012-103