CVE-2014-1480 — UI Misrepresentation / Clickjacking in Mozilla Firefox

CWE-1021 — UI Misrepresentation / Clickjacking6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.5%
top 33.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Mozilla FirefoxMozilla SeamonkeyCanonical Ubuntu Linux+5 more
Timeline
PublishedFeb 6
Latest updateMay 13

Description

The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages7 packages

▶NVDmozilla/firefox< 27.0
▶NVDmozilla/seamonkey< 2.24
▶NVDoracle/solaris11.3
▶NVDopensuse/opensuse11.4, 12.3, 13.1+2

Also affects: Ubuntu Linux 12.04, 12.10, 13.10

🔴Vulnerability Details

2
GHSA
GHSA-3vxf-9p4v-pvw4: The file-download implementation in Mozilla Firefox before 27↗2022-05-13
▶
CVEList
CVE-2014-1480: The file-download implementation in Mozilla Firefox before 27↗2014-02-06
▶

📋Vendor Advisories

2
Ubuntu
Firefox vulnerabilities↗2014-02-10
▶
Red Hat
Mozilla: UI selection timeout missing on download prompts (MFSA 2014-03)↗2014-02-04
▶

💬Community

1
Bugzilla
CVE-2014-1480 Mozilla: UI selection timeout missing on download prompts (MFSA 2014-03)↗2014-02-04
▶
CVE-2014-1480 — UI Misrepresentation / Clickjacking | cvebase