Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-3131 — Uncontrolled Search Path Element in Mozilla Firefox

CWE-427 — Uncontrolled Search Path Element6 documents5 sources
Severity
9.3CRITICALNVD
EPSS
10.2%
top 6.84%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird
Timeline
PublishedAug 26
Latest updateMay 14

Description

Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDmozilla/firefox3.5.11+87
▶NVDmozilla/seamonkey2.0.6+40
▶NVDmozilla/thunderbird3.0.6+67

🔴Vulnerability Details

2
GHSA
GHSA-4qrh-29x8-rv94: Untrusted search path vulnerability in Mozilla Firefox before 3↗2022-05-14
▶
CVEList
CVE-2010-3131: Untrusted search path vulnerability in Mozilla Firefox before 3↗2010-08-26
▶

💥Exploits & PoCs

2
Exploit-DB
Mozilla Thunderbird - 'dwmapi.dll' DLL Hijacking↗2010-08-25
▶
Exploit-DB
Mozilla Firefox 3.6.8 - 'dwmapi.dll' DLL Hijacking↗2010-08-24
▶

📐Framework References

1
CWE
Uncontrolled Search Path Element↗
▶
CVE-2010-3131 — Uncontrolled Search Path Element | cvebase