Secure-site spoof (requires security warning dialog) — Mozilla

2006-04-1300:00:00

Mozilla Foundation

www.mozilla.org

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

EPSS

0.123

Percentile

95.4%

JSON

Tristor reports that it was possible to spoof the browser’s secure-site indicators (the lock icon, the site name in the URL field, the gold URL field background in Firefox) by first loading the target secure site in a pop-up window, then changing its location to a different site.

Affected configurations

Vulners

Node

mozillafirefoxRange<1.0.8

mozillafirefoxRange<1.5

mozillamozilla_suiteRange<1.7.13

mozillaseamonkeyRange<1

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillamozilla_suite*cpe:2.3:a:mozilla:mozilla_suite:*:*:*:*:*:*:*:*
mozillaseamonkey*cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	mozilla_suite	*	cpe:2.3:a:mozilla:mozilla_suite::::::::
mozilla	seamonkey	*	cpe:2.3:a:mozilla:seamonkey::::::::