CVE-2010-2763 — Cross-site Scripting in Mozilla Firefox

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.5%
top 32.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird
Timeline
PublishedSep 9
Latest updateMay 17

Description

The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7, and SeaMonkey before 2.0.7 does not properly restrict scripted functions, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted function.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDmozilla/firefox3.5.11+80
▶NVDmozilla/seamonkey2.0.6+40
▶NVDmozilla/thunderbird3.0.6+64

🔴Vulnerability Details

2
GHSA
GHSA-39cx-g389-rw9j: The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3↗2022-05-17
▶
CVEList
CVE-2010-2763: The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3↗2010-09-09
▶

📋Vendor Advisories

2
Ubuntu
Thunderbird regression↗2010-09-16
▶
Ubuntu
Thunderbird vulnerabilities↗2010-09-08
▶

💬Community

1
Bugzilla
CVE-2010-2763 Mozilla XSS using SJOW scripted function (MFSA 2010-60)↗2010-09-08
▶
CVE-2010-2763 — Cross-site Scripting in Mozilla Firefox | cvebase