CVE-2010-0171 — Cross-site Scripting in Mozilla Seamonkey

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.5%
top 33.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla SeamonkeyMozilla ThunderbirdMozilla Firefox
Timeline
PublishedMar 25
Latest updateMay 2

Description

Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDmozilla/seamonkey2.0.2+22
▶NVDmozilla/thunderbird3.0.1+31
▶NVDmozilla/firefox19 versions+18

Patches

Patch: www.mozilla.org ↗Patch: www.securityfocus.com ↗Patch: www.mozilla.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-vv9f-p8wq-vp27: Mozilla Firefox 3↗2022-05-02
▶
CVEList
CVE-2010-0171: Mozilla Firefox 3↗2010-03-25
▶

📋Vendor Advisories

1
Red Hat
firefox/thunderbird/seamonkey: XSS using addEventListener and setTimeout on a wrapped object (MFSA 2010-12)↗2010-03-23
▶

💬Community

1
Bugzilla
CVE-2010-0171 firefox/thunderbird/seamonkey: XSS using addEventListener and setTimeout on a wrapped object (MFSA 2010-12)↗2010-03-24
▶
CVE-2010-0171 — Cross-site Scripting in Mozilla | cvebase