CVE-2008-4066
Mozilla low surrogates stripped from JavaScript before execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav�ascript" sequence, aka "HTML escaped low surrogates bug."
Mozilla Firefox versión 2.0.0.14, y otras versiones anteriores a 2.0.0.17, permiten a los atacantes remotos omitir los mecanismos de protección de cross-site scripting (XSS) y conducir ataques de tipo XSS por medio de caracteres sustitutos bajos con escape de HTML que son ignorados por el analizador HTML, como es demostrado por una secuencia "jav?ascript", también se conoce como "HTML escaped low surrogates bug."
CVSS Scores
SSVC
- Decision:-
Timeline
- 2008-09-12 CVE Reserved
- 2008-09-24 CVE Published
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- 2025-01-19 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (46)
| URL | Tag | Source |
|---|---|---|
| http://download.novell.com/Download?buildid=WZXONb-tqBw~ | X_refsource_confirm | |
| http://jvn.jp/en/jp/JVN96950482/index.html | Third Party Advisory | |
| http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000058.html | Third Party Advisory | |
| http://secunia.com/advisories/32185 | Third Party Advisory | |
| http://secunia.com/advisories/32196 | Third Party Advisory | |
| http://www.mozilla.org/security/announce/2008/mfsa2008-43.html | X_refsource_confirm | |
| http://www.securityfocus.com/bid/31346 | Vdb Entry | |
| http://www.securitytracker.com/id?1020920 | Vdb Entry | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=448166 | X_refsource_confirm | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/45358 | Vdb Entry | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8880 | Signature |
| URL | Date | SRC |
|---|---|---|
| http://blogs.technet.com/bluehat/archive/2008/08/14/targeted-fuzzing.aspx | 2024-08-07 | |
| http://www.thespanner.co.uk/2008/06/30/javascript-protocol-fuzz-results | 2024-08-07 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 2.0.0.14 Search vendor "Mozilla" for product "Firefox" and version "2.0.0.14" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 2.0.0.15 Search vendor "Mozilla" for product "Firefox" and version "2.0.0.15" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 2.0.0.16 Search vendor "Mozilla" for product "Firefox" and version "2.0.0.16" | - |
Affected
| ||||||