CVE-2008-2800 — Cross-site Scripting in Mozilla Firefox

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
2.0%
top 16.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla Seamonkey
Timeline
PublishedJul 7
Latest updateMay 1

Description

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors involving (1) an event handler attached to an outer window, (2) a SCRIPT element in an unloaded document, or (3) the onreadystatechange handler in conjunction with an XMLHttpRequest.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDmozilla/firefox2.0.0.14+14
▶NVDmozilla/seamonkey1.1.9+8

🔴Vulnerability Details

1
GHSA
GHSA-cq3g-fvgf-3m32: Mozilla Firefox before 2↗2022-05-01
▶

📋Vendor Advisories

2
Red Hat
Firefox XSS attacks↗2008-07-02
▶
Ubuntu
Firefox vulnerabilities↗2008-07-02
▶

💬Community

1
Bugzilla
CVE-2008-2800 Firefox XSS attacks↗2008-06-24
▶
CVE-2008-2800 — Cross-site Scripting in Mozilla Firefox | cvebase