1. Home
  2. Vulnerabilities
  3. CVE-2009-1839

CVE-2009-1839

CVSS v2.0 5.4 (Medium)
54% Progress
EPSS 1.70 % (88th)
1.70% Progress
Affected Products 1
Advisories 6
Info CVSS EPSS Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Mozilla Firefox 3 before 3.0.11 associates an incorrect principal with a file: URL loaded through the location bar, which allows user-assisted remote attackers to bypass intended access restrictions and read files via a crafted HTML document, aka a "file-URL-to-file-URL scripting" attack.

Weaknesses
CWE-264
Permissions, Privileges, and Access Controls
CVE Status
PUBLISHED
CNA
Red Hat, Inc.
Published Date
2009-06-12 21:30:00
(15 years ago)
Updated Date
2017-09-29 01:34:36
(7 years ago)

Affected Products

Mozilla

Configuration #1

    CPE23 From Up To
  Mozilla Firefox 3.0.10 and prior versions cpe:2.3:a:mozilla:firefox <= 3.0.10
  Mozilla Firefox 3.0 cpe:2.3:a:mozilla:firefox:3.0
  Mozilla Firefox 3.0 Alpha cpe:2.3:a:mozilla:firefox:3.0:alpha
  Mozilla Firefox 3.0 Beta2 cpe:2.3:a:mozilla:firefox:3.0:beta2
  Mozilla Firefox 3.0 Beta5 cpe:2.3:a:mozilla:firefox:3.0:beta5
  Mozilla Firefox 3.0.1 cpe:2.3:a:mozilla:firefox:3.0.1
  Mozilla Firefox 3.0.2 cpe:2.3:a:mozilla:firefox:3.0.2
  Mozilla Firefox 3.0.3 cpe:2.3:a:mozilla:firefox:3.0.3
  Mozilla Firefox 3.0.4 cpe:2.3:a:mozilla:firefox:3.0.4
  Mozilla Firefox 3.0.5 cpe:2.3:a:mozilla:firefox:3.0.5
  Mozilla Firefox 3.0.6 cpe:2.3:a:mozilla:firefox:3.0.6
  Mozilla Firefox 3.0.7 cpe:2.3:a:mozilla:firefox:3.0.7
  Mozilla Firefox 3.0.8 cpe:2.3:a:mozilla:firefox:3.0.8
  Mozilla Firefox 3.0.9 cpe:2.3:a:mozilla:firefox:3.0.9
  Mozilla Firefox 3.0beta5 cpe:2.3:a:mozilla:firefox:3.0beta5
  Mozilla Firefox 3.1 Beta1 cpe:2.3:a:mozilla:firefox:3.1:beta1