CVE-2009-2472

Mozilla multiple cross origin wrapper bypasses

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."

Mozilla Firefox anteriores a v3.0.12 no usa siempre XPCCrossOriginWrapper cuando es requerido durante la construcción del objeto, lo que permite a atacantes remotos eludir la "Same Origin Policy" y realizar ataques de secuencias de comandos en sitios cruzados (XSS) mediante un documento manipulado, relacionado con una "cross origin wrapper bypass."

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-07-15 CVE Reserved
2009-07-22 CVE Published
2023-06-10 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (20)

URL	Tag	Source
http://secunia.com/advisories/35914	Third Party Advisory
http://secunia.com/advisories/35944	Third Party Advisory
http://secunia.com/advisories/36005	Third Party Advisory
http://secunia.com/advisories/36145	Third Party Advisory
http://www.vupen.com/english/advisories/2009/2152	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9497	Signature

URL	Date	SRC

URL	Date	SRC
http://www.mozilla.org/security/announce/2009/mfsa2009-40.html	2021-07-29
http://www.securityfocus.com/bid/35758	2021-07-29
http://www.vupen.com/english/advisories/2009/1972	2021-07-29
https://bugzilla.mozilla.org/show_bug.cgi?id=479288	2021-07-29
https://bugzilla.mozilla.org/show_bug.cgi?id=481434	2021-07-29
https://bugzilla.mozilla.org/show_bug.cgi?id=497102	2021-07-29

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html	2021-07-29
http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html	2021-07-29
http://rhn.redhat.com/errata/RHSA-2009-1162.html	2021-07-29
http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1	2021-07-29
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1	2021-07-29
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01032.html	2021-07-29
https://access.redhat.com/security/cve/CVE-2009-2472	2009-07-22
https://bugzilla.redhat.com/show_bug.cgi?id=512147	2009-07-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				< 3.0.12 Search vendor "Mozilla" for product "Firefox" and version " < 3.0.12"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				10 Search vendor "Fedoraproject" for product "Fedora" and version "10"		-		Affected
Suse Search vendor "Suse"		Linux Enterprise Debuginfo Search vendor "Suse" for product "Linux Enterprise Debuginfo"				10 Search vendor "Suse" for product "Linux Enterprise Debuginfo" and version "10"		sp2		Affected
Suse Search vendor "Suse"		Linux Enterprise Debuginfo Search vendor "Suse" for product "Linux Enterprise Debuginfo"				11 Search vendor "Suse" for product "Linux Enterprise Debuginfo" and version "11"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				11.0 Search vendor "Opensuse" for product "Opensuse" and version "11.0"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				11.1 Search vendor "Opensuse" for product "Opensuse" and version "11.1"		-		Affected
Suse Search vendor "Suse"		Linux Enterprise Desktop Search vendor "Suse" for product "Linux Enterprise Desktop"				10 Search vendor "Suse" for product "Linux Enterprise Desktop" and version "10"		sp2		Affected
Suse Search vendor "Suse"		Linux Enterprise Desktop Search vendor "Suse" for product "Linux Enterprise Desktop"				11 Search vendor "Suse" for product "Linux Enterprise Desktop" and version "11"		-		Affected
Suse Search vendor "Suse"		Linux Enterprise Server Search vendor "Suse" for product "Linux Enterprise Server"				10 Search vendor "Suse" for product "Linux Enterprise Server" and version "10"		sp2		Affected
Suse Search vendor "Suse"		Linux Enterprise Server Search vendor "Suse" for product "Linux Enterprise Server"				11 Search vendor "Suse" for product "Linux Enterprise Server" and version "11"		-		Affected