CVE-2009-3988
Mozilla Firefox showModalDialog Cross-Domain Scripting Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.
Mozilla Firefox v3.0.x anterior a la v3.0.18 y v3.5.x anterior a la v3.5.8, y SeaMonkey anterior a la v2.0.3, no restringen de forma adecuada el acceso a las propiedades del objeto en showModalDialog, lo que permite a atacantes remotos saltarse la Same Origin Policy y conducir un ataque de ejecución de secuencias de comandos en sitios cruzados a través de valores manipulados dialogArguments.
This vulnerability allows remote attackers to bypass specific script execution enforcements on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
The specific flaw exists in the lack of cross domain policy enforcement. Through usage of the showModalDialog() JavaScript method an attacker can gather sensitive information from another website. This vulnerability can be exploited to obtain website credentials not originating from the attacking site.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-11-19 CVE Reserved
- 2010-02-18 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (19)
URL | Tag | Source |
---|---|---|
http://secunia.com/advisories/37242 | Third Party Advisory | |
http://secunia.com/advisories/38847 | Third Party Advisory | |
http://www.mozilla.org/security/announce/2010/mfsa2010-04.html | X_refsource_confirm | |
http://www.vupen.com/english/advisories/2010/0405 | Vdb Entry | |
https://bugzilla.mozilla.org/show_bug.cgi?id=504862 | X_refsource_confirm | |
https://exchange.xforce.ibmcloud.com/vulnerabilities/56362 | Vdb Entry | |
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355 | Signature | |
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384 | Signature |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | <= 3.0.17 Search vendor "Mozilla" for product "Firefox" and version " <= 3.0.17" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0 Search vendor "Mozilla" for product "Firefox" and version "3.0" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.1 Search vendor "Mozilla" for product "Firefox" and version "3.0.1" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.2 Search vendor "Mozilla" for product "Firefox" and version "3.0.2" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.3 Search vendor "Mozilla" for product "Firefox" and version "3.0.3" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.4 Search vendor "Mozilla" for product "Firefox" and version "3.0.4" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.5 Search vendor "Mozilla" for product "Firefox" and version "3.0.5" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.6 Search vendor "Mozilla" for product "Firefox" and version "3.0.6" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.7 Search vendor "Mozilla" for product "Firefox" and version "3.0.7" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.8 Search vendor "Mozilla" for product "Firefox" and version "3.0.8" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.9 Search vendor "Mozilla" for product "Firefox" and version "3.0.9" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.10 Search vendor "Mozilla" for product "Firefox" and version "3.0.10" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.11 Search vendor "Mozilla" for product "Firefox" and version "3.0.11" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.12 Search vendor "Mozilla" for product "Firefox" and version "3.0.12" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.13 Search vendor "Mozilla" for product "Firefox" and version "3.0.13" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.14 Search vendor "Mozilla" for product "Firefox" and version "3.0.14" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.0.15 Search vendor "Mozilla" for product "Firefox" and version "3.0.15" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.5 Search vendor "Mozilla" for product "Firefox" and version "3.5" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.5.1 Search vendor "Mozilla" for product "Firefox" and version "3.5.1" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.5.2 Search vendor "Mozilla" for product "Firefox" and version "3.5.2" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.5.3 Search vendor "Mozilla" for product "Firefox" and version "3.5.3" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.5.4 Search vendor "Mozilla" for product "Firefox" and version "3.5.4" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.5.5 Search vendor "Mozilla" for product "Firefox" and version "3.5.5" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.5.6 Search vendor "Mozilla" for product "Firefox" and version "3.5.6" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.5.7 Search vendor "Mozilla" for product "Firefox" and version "3.5.7" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Seamonkey Search vendor "Mozilla" for product "Seamonkey" | 2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Seamonkey Search vendor "Mozilla" for product "Seamonkey" | 2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0" | alpha_1 |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Seamonkey Search vendor "Mozilla" for product "Seamonkey" | 2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0" | alpha_2 |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Seamonkey Search vendor "Mozilla" for product "Seamonkey" | 2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0" | alpha_3 |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Seamonkey Search vendor "Mozilla" for product "Seamonkey" | 2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0" | beta_1 |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Seamonkey Search vendor "Mozilla" for product "Seamonkey" | 2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0" | beta_2 |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Seamonkey Search vendor "Mozilla" for product "Seamonkey" | 2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0" | rc1 |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Seamonkey Search vendor "Mozilla" for product "Seamonkey" | 2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0" | rc2 |
Affected
|