CVE-2007-6589 — Cross-site Scripting in Mozilla Firefox

CWE-79 — Cross-site Scripting2 documents2 sources
Severity
4.3MEDIUMNVD
EPSS
0.6%
top 30.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla Seamonkey
Timeline
PublishedDec 28
Latest updateMay 1

Description

The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDmozilla/firefox2.0.0.9

🔴Vulnerability Details

1
GHSA
GHSA-mjp2-qv3r-5pqp: The jar protocol handler in Mozilla Firefox before 2↗2022-05-01
▶
CVE-2007-6589 — Cross-site Scripting in Mozilla Firefox | cvebase