XSS with XPCNativeWrapper(window).Function(...) — Mozilla

2006-07-2500:00:00

Mozilla Foundation

www.mozilla.org

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.32

Percentile

97.0%

JSON

shutdown reports that cross-site scripting (XSS) attacks could be performed using the construct XPCNativeWrapper(window).Function(…), which created a function that appeared to belong to the window in question even after it had been navigated to the target site.

Affected configurations

Vulners

Node

mozillafirefoxRange<1.5.0.5

mozillaseamonkeyRange<1.0.3

mozillathunderbirdRange<1.5.0.5

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillaseamonkey*cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
mozillathunderbird*cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	seamonkey	*	cpe:2.3:a:mozilla:seamonkey::::::::
mozilla	thunderbird	*	cpe:2.3:a:mozilla:thunderbird::::::::