CVE-2011-4688
published 2011-12-07CVE-2011-4688: Mozilla Firefox 8.0.1 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes…
PriorityP420medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.82%
76.6th percentile
Mozilla Firefox 8.0.1 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 8.0.1 | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: Does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading
vendor_redhat·2011-12-06·CVSS 5.0
CVE-2011-4688 [MEDIUM] firefox: Does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading
firefox: Does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading
Mozilla Firefox 8.0.1 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
Package: firefox (Red Hat Enterprise Linux 4) - Not affected
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
GHSA
GHSA-mp2h-wg49-xrpx: Mozilla Firefox 8
ghsa_unreviewed·2022-05-17
CVE-2011-4688 [MEDIUM] GHSA-mp2h-wg49-xrpx: Mozilla Firefox 8
Mozilla Firefox 8.0.1 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
No detection rules found.
No public exploits indexed.
http://lcamtuf.coredump.cx/cachetime/http://secunia.com/advisories/47090https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13770http://lcamtuf.coredump.cx/cachetime/http://secunia.com/advisories/47090https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13770
2011-12-07
Published