Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2014-1510

CWE-269 — Improper Privilege Management9 documents8 sources
Severity
9.8CRITICAL
EPSS
71.1%
top 1.29%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
16
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird+13 more
Timeline
PublishedMar 19
Latest updateMay 13

Description

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages10 packages

▶NVDmozilla/firefox24.0 — 24.4+1
▶NVDmozilla/seamonkey< 2.25
▶NVDopensuse/opensuse11.4, 12.3, 13.1+2

Also affects: Debian Linux 7.0, 8.0, Ubuntu Linux 12.04, 12.10, 13.10, Enterprise Linux 6.5

🔴Vulnerability Details

3
GHSA
GHSA-xmjr-qq5c-jp94: The Web IDL implementation in Mozilla Firefox before 28↗2022-05-13
▶
CVEList
CVE-2014-1510: The Web IDL implementation in Mozilla Firefox before 28↗2014-03-19
▶
VulnCheck
Mozilla Firefox Improper Privilege Management↗2014
▶

💥Exploits & PoCs

1
Exploit-DB
Mozilla Firefox - WebIDL Privileged JavaScript Injection (Metasploit)↗2014-08-28
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2014-03-21
▶
Red Hat
Mozilla: Privilege escalation using WebIDL-implemented APIs (MFSA 2014-29)↗2014-03-18
▶
Ubuntu
Firefox vulnerabilities↗2014-03-18
▶

💬Community

1
Bugzilla
CVE-2014-1510 CVE-2014-1511 Mozilla: Privilege escalation using WebIDL-implemented APIs (MFSA 2014-29)↗2014-03-18
▶