CVE-2010-0170

medium

Description

Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.

References

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8602

https://bugzilla.mozilla.org/show_bug.cgi?id=541530

http://www.vupen.com/english/advisories/2010/0692

http://www.securityfocus.com/bid/38919

http://www.securityfocus.com/bid/38918

http://www.mozilla.org/security/announce/2010/mfsa2010-10.html

http://www.mandriva.com/security/advisories?name=MDVSA-2010:070

Details

Source: Mitre, NVD

Published: 2010-03-25

Updated: 2017-09-19

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium