CVEvulnerability
CVE-2010-0172
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-03-25
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Description
toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to spoof an authorization dialog and capture credentials by demanding HTTP authentication in opportunistic circumstances.
Affected configurations
• mozilla firefox 3.6
References
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:070 www.mandriva.com
- http://www.mozilla.org/security/announce/2010/mfsa2010-15.html Patch
- http://www.securityfocus.com/bid/38918 www.securityfocus.com
- http://www.vupen.com/english/advisories/2010/0692 www.vupen.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=537862 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8281 oval.cisecurity.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:070 www.mandriva.com
- http://www.mozilla.org/security/announce/2010/mfsa2010-15.html Patch
- http://www.securityfocus.com/bid/38918 www.securityfocus.com
- http://www.vupen.com/english/advisories/2010/0692 www.vupen.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=537862 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8281 oval.cisecurity.org