CVEvulnerability

CVE-2008-0418

4.3 MEDIUM Published 2008-02-08 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-02-08
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-22

Description

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.

Affected configurations

• mozilla firefox (<= 2.0.0.11) • mozilla seamonkey (<= 1.1.7) • mozilla thunderbird (<= 2.0.0.11)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References