CVE-2007-5947 — Cross-site Scripting in Mozilla Firefox

CWE-79 — Cross-site Scripting8 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
7.9%
top 7.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla Seamonkey
Timeline
PublishedNov 14
Latest updateMay 1

Description

The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDmozilla/firefox2.0.0.9+8
▶NVDmozilla/seamonkey1.1.6+5

🔴Vulnerability Details

2
GHSA
GHSA-mjp2-qv3r-5pqp: The jar protocol handler in Mozilla Firefox before 2↗2022-05-01
▶
GHSA
GHSA-2cph-6c7j-7mmc: The jar protocol handler in Mozilla Firefox before 2↗2022-05-01
▶

📋Vendor Advisories

3
Ubuntu
Firefox regression↗2007-12-04
▶
Ubuntu
Firefox vulnerabilities↗2007-11-26
▶
Red Hat
jar: protocol XSS↗2007-02-08
▶

💬Community

1
Bugzilla
CVE-2007-5947 Mozilla jar: protocol XSS↗2007-11-21
▶
CVE-2007-5947 — Cross-site Scripting in Mozilla Firefox | cvebase