Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-1562 — Sensitive Information Exposure in Mozilla Firefox

CWE-200 — Sensitive Information Exposure15 documents7 sources
Severity
6.8MEDIUMNVD
EPSS
30.3%
top 3.30%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Mozilla FirefoxCanonical Ubuntu Linux
Timeline
PublishedMar 21
Latest updateMay 1

Description

The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

▶NVDmozilla/firefox1.5 — 1.5.0.11+1

Also affects: Ubuntu Linux 5.10, 6.06, 6.10

🔴Vulnerability Details

1
GHSA
GHSA-ccpp-7p46-hqr2: The FTP protocol implementation in Mozilla Firefox before 1↗2022-05-01
▶

💥Exploits & PoCs

1
Exploit-DB
Mozilla FireFox 1.5.x/2.0 - FTP PASV Port-Scanning↗2007-03-21
▶

📋Vendor Advisories

6
Red Hat
Multiple Firefox flaws (CVE-2007-1562, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)↗2007-05-31
▶
Red Hat
Multiple Firefox flaws (CVE-2007-1562, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)↗2007-05-31
▶
Red Hat
Multiple Firefox flaws (CVE-2007-1562, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)↗2007-05-31
▶
Red Hat
Multiple Firefox flaws (CVE-2007-1562, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)↗2007-05-31
▶
Ubuntu
Firefox vulnerability↗2007-03-27
▶

💬Community

6
HackerOne
lib/net/ftp.rb: trusting PASV responses allow client abuse↗2021-07-08
▶
Bugzilla
CVE-2007-1562 security flaw↗2018-08-16
▶
Bugzilla
CVE-2007-1362 Multiple Firefox flaws (CVE-2007-1562, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)↗2007-05-31
▶
Bugzilla
CVE-2007-1362 Miltiple Seamonkey flaws (CVE-2007-1562, CVE-2007-1558, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)↗2007-05-31
▶
Bugzilla
CVE-2007-1362 Multiple Firefox flaws (CVE-2007-1562, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)↗2007-05-29
▶