CVE-2014-1530

CWE-79 — Cross-site Scripting (XSS)8 documents7 sources
Severity
6.1MEDIUM
EPSS
0.9%
top 24.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird+12 more
Timeline
PublishedApr 30
Latest updateMay 13

Description

The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages10 packages

▶NVDmozilla/firefox24.0 — 24.5+1
▶NVDmozilla/seamonkey< 2.26
▶Ubuntufirefox< 29.0+build1-0ubuntu0.14.04.2
▶Ubuntuthunderbird< 1:24.5.0+build1-0ubuntu0.14.04.1

Also affects: Debian Linux 7.0, 8.0, Fedora 19, 20, Ubuntu Linux 12.04, 12.10, 13.10, 14.04, Enterprise Linux 6.5

🔴Vulnerability Details

3
GHSA
GHSA-rmp2-6gvc-xxrf: The docshell implementation in Mozilla Firefox before 29↗2022-05-13
▶
CVEList
CVE-2014-1530: The docshell implementation in Mozilla Firefox before 29↗2014-04-30
▶
OSV
CVE-2014-1530: The docshell implementation in Mozilla Firefox before 29↗2014-04-29
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2014-04-30
▶
Red Hat
Mozilla: Cross-site scripting (XSS) using history navigations (MFSA 2014-43)↗2014-04-29
▶
Ubuntu
Firefox vulnerabilities↗2014-04-29
▶

💬Community

1
Bugzilla
CVE-2014-1530 Mozilla: Cross-site scripting (XSS) using history navigations (MFSA 2014-43)↗2014-04-29
▶
CVE-2014-1530 (MEDIUM CVSS 6.1) | The docshell implementation in Mozi | cvebase.io