NVD

Id
51147  
Name
CVE-2009-3988  
Description
Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2010-02-22  
Modified Date
2010-08-21  
Seq
2009-3988  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
259284 51147 CVE-2009-3988 FEDORA-2010-1932  View
259285 51147 CVE-2009-3988 FEDORA-2010-1936  View
259286 51147 CVE-2009-3988 FEDORA-2010-1727  View
259287 51147 CVE-2009-3988 SUSE-SA:2010:015  View
259288 51147 CVE-2009-3988 oval:org.mitre.oval:def:8355  View
259289 51147 CVE-2009-3988 oval:org.mitre.oval:def:9384  View
259290 51147 CVE-2009-3988 DSA-1999  View
259291 51147 CVE-2009-3988 MDVSA-2010:042  View
259292 51147 CVE-2009-3988 http://www.mozilla.org/security/announce/2010/mfsa2010-04.html  View
259293 51147 CVE-2009-3988 RHSA-2010:0112  View
259294 51147 CVE-2009-3988 USN-895-1  View
259295 51147 CVE-2009-3988 USN-896-1  View
259296 51147 CVE-2009-3988 ADV-2010-0405  View
259297 51147 CVE-2009-3988 mozilla-showmodaldialog-xss(56362)  View
259298 51147 CVE-2009-3988 https://bugzilla.mozilla.org/show_bug.cgi?id=504862  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
35351 JVNDB-2010-001131 Mozilla Firefox/SeaMonkey におけるクロスサイトスクリプティングの脆弱性 Mozilla Firefox/SeaMonkey には、showModalDialog のオブジェクトプロパティに対する読み込み権限を適切に制限しないため、同一生成元ポリシーを回避され、クロスサイトスクリプティング攻撃を実行される脆弱性が存在します。 CVE-2009-3988 41419 CVE-2009-3988 51147 5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001131.html 2010-02-17 2010-03-09 View