CVEvulnerability

CVE-2006-2894

4.0 MEDIUM Published 2006-06-07 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-06-07
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:N
Weaknesses
CWE-20

Description

Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allow user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.

Affected configurations

• mozilla firefox (<= 2.0.0.8) • mozilla firefox 1.5.0.4 • mozilla mozilla suite 1.7.13 • mozilla seamonkey (<= 1.1.4) • mozilla seamonkey 1.0.2 • netscape navigator (<= 8.1)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References