CVE-2010-2764 — Mozilla Firefox vulnerability

CWE-2649 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.9%
top 24.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird
Timeline
PublishedSep 9
Latest updateMay 17

Description

Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict read access to the statusText property of XMLHttpRequest objects, which allows remote attackers to discover the existence of intranet web servers via cross-origin requests.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶NVDmozilla/firefox3.5.11+87
▶NVDmozilla/seamonkey2.0.6+40
▶NVDmozilla/thunderbird3.0.6+67

🔴Vulnerability Details

2
GHSA
GHSA-8hxp-g3r8-hhm2: Mozilla Firefox before 3↗2022-05-17
▶
CVEList
CVE-2010-2764: Mozilla Firefox before 3↗2010-09-09
▶

📋Vendor Advisories

5
Ubuntu
Firefox and Xulrunner regression↗2010-09-16
▶
Ubuntu
Thunderbird regression↗2010-09-16
▶
Ubuntu
Thunderbird vulnerabilities↗2010-09-08
▶
Ubuntu
Firefox and Xulrunner vulnerabilities↗2010-09-08
▶
Red Hat
Mozilla Information leak via XMLHttpRequest statusText (MFSA 2010-63)↗2010-09-07
▶

💬Community

1
Bugzilla
CVE-2010-2764 Mozilla Information leak via XMLHttpRequest statusText (MFSA 2010-63)↗2010-09-03
▶
CVE-2010-2764 — Mozilla Firefox vulnerability | cvebase