1. Home
  2. Vulnerabilities
  3. CVE-2009-1840

CVE-2009-1840

CVSS v2.0 9.3 (High)
93% Progress
EPSS 1.31 % (86th)
1.31% Progress
Affected Products 3
Advisories 6
Info CVSS EPSS Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do not check content policy before loading a script file into a XUL document, which allows remote attackers to bypass intended access restrictions via a crafted HTML document, as demonstrated by a "web bug" in an e-mail message, or web script or an advertisement in a web page.

Weaknesses
CWE-264
Permissions, Privileges, and Access Controls
CVE Status
PUBLISHED
CNA
Red Hat, Inc.
Published Date
2009-06-12 21:30:00
(15 years ago)
Updated Date
2017-09-29 01:34:36
(7 years ago)

Affected Products

Mozilla

Configuration #1

    CPE23 From Up To
  Mozilla Firefox 3.0.10 and prior versions cpe:2.3:a:mozilla:firefox <= 3.0.10
  Mozilla Firefox 3.0 cpe:2.3:a:mozilla:firefox:3.0
  Mozilla Firefox 3.0 Alpha cpe:2.3:a:mozilla:firefox:3.0:alpha
  Mozilla Firefox 3.0 Beta2 cpe:2.3:a:mozilla:firefox:3.0:beta2
  Mozilla Firefox 3.0 Beta5 cpe:2.3:a:mozilla:firefox:3.0:beta5
  Mozilla Firefox 3.0.1 cpe:2.3:a:mozilla:firefox:3.0.1
  Mozilla Firefox 3.0.2 cpe:2.3:a:mozilla:firefox:3.0.2
  Mozilla Firefox 3.0.3 cpe:2.3:a:mozilla:firefox:3.0.3
  Mozilla Firefox 3.0.4 cpe:2.3:a:mozilla:firefox:3.0.4
  Mozilla Firefox 3.0.5 cpe:2.3:a:mozilla:firefox:3.0.5
  Mozilla Firefox 3.0.6 cpe:2.3:a:mozilla:firefox:3.0.6
  Mozilla Firefox 3.0.7 cpe:2.3:a:mozilla:firefox:3.0.7
  Mozilla Firefox 3.0.8 cpe:2.3:a:mozilla:firefox:3.0.8
  Mozilla Firefox 3.0.9 cpe:2.3:a:mozilla:firefox:3.0.9
  Mozilla Firefox 3.0beta5 cpe:2.3:a:mozilla:firefox:3.0beta5
  Mozilla Firefox 3.1 Beta1 cpe:2.3:a:mozilla:firefox:3.1:beta1
  Mozilla Seamonkey cpe:2.3:a:mozilla:seamonkey
  Mozilla Thunderbird cpe:2.3:a:mozilla:thunderbird