Lucene search

K
cve[email protected]CVE-2009-1312
HistoryApr 22, 2009 - 6:30 p.m.

CVE-2009-1312

2009-04-2218:30:00
CWE-16
web.nvd.nist.gov
38
4
cve-2009-1312
mozilla firefox
seamonkey
xss
cross-site scripting
http
security
vulnerability

8.4 High

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.034 Low

EPSS

Percentile

91.3%

Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.

References

Social References

More

8.4 High

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.034 Low

EPSS

Percentile

91.3%

Related for CVE-2009-1312