CVE-2010-0170 — Cross-site Scripting in Mozilla Firefox

CWE-79 — Cross-site Scripting6 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.5%
top 34.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird
Timeline
PublishedMar 25
Latest updateMay 17

Description

Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDmozilla/firefox3.6.22+23
▶NVDmozilla/seamonkey2.1+52

🔴Vulnerability Details

2
GHSA
GHSA-f562-g9gh-gpgg: Mozilla Firefox before 3↗2022-05-17
▶
GHSA
GHSA-h768-g6c9-cwmw: Mozilla Firefox 3↗2022-05-02
▶

📋Vendor Advisories

1
Red Hat
Mozilla: XSS via plugins and shadowed window.location object (MFSA 2011-38)↗2011-09-28
▶

💬Community

1
Bugzilla
Plugins can be fooled by window.location (again)↗2012-03-12
▶