Lucene search

Mozilla FoundationMFSA2008-53

HistoryNov 12, 2008 - 12:00 a.m.

XSS and JavaScript privilege escalation via session restore — Mozilla

2008-11-1200:00:00

Mozilla Foundation

www.mozilla.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.002

Percentile

55.7%

JSON

Security researcher David Bloom reported that the browser’s session restore feature can be used to violate the same-origin policy and run JavaScript in the context of another site. Any otherwise unexploitable crash can be used to force the user into the session restore state

Affected configurations

Vulners

Node

mozillafirefoxRange<2.0.0.18

mozillafirefoxRange<3.0.4

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5019

bugzilla.mozilla.org/buglist.cgi?bug_id=459906,460983

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.002

Percentile

55.7%

JSON

Related for MFSA2008-53