CVEvulnerability
CVE-2008-0367
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-01-19
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-200
Description
Mozilla Firefox 2.0.0.11, 3.0b2, and possibly earlier versions, when prompting for HTTP Basic Authentication, displays the site requesting the authentication after the Realm text, which might make it easier for remote HTTP servers to conduct phishing and spoofing attacks.
Affected configurations
• mozilla firefox (<= 2.0.0.11)
• mozilla firefox 3.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspx Third Party Advisory
- http://aviv.raffon.net/2008/01/05/FirefoxDialogSpoofingFAQ.aspx Third Party Advisory
- http://blog.mozilla.com/security/2008/01/04/basicauth-dialog-realm-value-spoofing/ Vendor Advisory
- http://www.securityfocus.com/archive/1/485732/100/200/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/485738/100/200/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/27111 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=244273 Issue Tracking, Vendor Advisory
- http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspx Third Party Advisory
- http://aviv.raffon.net/2008/01/05/FirefoxDialogSpoofingFAQ.aspx Third Party Advisory
- http://blog.mozilla.com/security/2008/01/04/basicauth-dialog-realm-value-spoofing/ Vendor Advisory
- http://www.securityfocus.com/archive/1/485732/100/200/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/485738/100/200/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/27111 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=244273 Issue Tracking, Vendor Advisory