CVEvulnerability
CVE-2007-6589
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2007-12-28
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.
Affected configurations
• mozilla firefox (<= 2.0.0.9)
• mozilla seamonkey (<= 1.1.6)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://blog.beford.org/?p=8 blog.beford.org
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 h20000.www2.hp.com
- http://osvdb.org/43477 osvdb.org
- http://www.mozilla.org/security/announce/2007/mfsa2007-37.html www.mozilla.org
- http://www.vupen.com/english/advisories/2008/0083 www.vupen.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=369814 bugzilla.mozilla.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=403331 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6033 oval.cisecurity.org
- http://blog.beford.org/?p=8 blog.beford.org
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 h20000.www2.hp.com
- http://osvdb.org/43477 osvdb.org
- http://www.mozilla.org/security/announce/2007/mfsa2007-37.html www.mozilla.org
- http://www.vupen.com/english/advisories/2008/0083 www.vupen.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=369814 bugzilla.mozilla.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=403331 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6033 oval.cisecurity.org