PRIOn knowledge basePRION:CVE-2010-2763Cross site scripting
5.9 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
67.7%
The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7, and SeaMonkey before 2.0.7 does not properly restrict scripted functions, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function.
References
lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
www.debian.org/security/2010/dsa-2106
www.mozilla.org/security/announce/2010/mfsa2010-60.html
www.vupen.com/english/advisories/2010/2323
bugzilla.mozilla.org/show_bug.cgi?id=585284
exchange.xforce.ibmcloud.com/vulnerabilities/61665
lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12114
Related
5.9 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
67.7%