Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-3014

Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location HTTP response header or (2) specifying the content of a Location HTTP response header.

Published

2009-08-31T16:30:06.967

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mozilla firefox ≤ 3.0.13 Yes
Application mozilla firefox 3.0.1 Yes
Application mozilla firefox 3.0.2 Yes
Application mozilla firefox 3.0.3 Yes
Application mozilla firefox 3.0.4 Yes
Application mozilla firefox 3.0.5 Yes
Application mozilla firefox 3.0.6 Yes
Application mozilla firefox 3.0.7 Yes
Application mozilla firefox 3.0.8 Yes
Application mozilla firefox 3.0.9 Yes
Application mozilla firefox 3.0.10 Yes
Application mozilla firefox 3.0.11 Yes
Application mozilla firefox 3.0.12 Yes
Application mozilla firefox 3.5 Yes
Application mozilla firefox 3.6 Yes
Application mozilla firefox 3.7 Yes
Application mozilla mozilla ≤ 1.7 Yes
Application mozilla mozilla 0.8 Yes
Application mozilla mozilla 0.9.2 Yes
Application mozilla mozilla 0.9.2.1 Yes
Application mozilla mozilla 0.9.3 Yes
Application mozilla mozilla 0.9.4 Yes
Application mozilla mozilla 0.9.4.1 Yes
Application mozilla mozilla 0.9.5 Yes
Application mozilla mozilla 0.9.6 Yes
Application mozilla mozilla 0.9.7 Yes
Application mozilla mozilla 0.9.8 Yes
Application mozilla mozilla 0.9.9 Yes
Application mozilla mozilla 0.9.35 Yes
Application mozilla mozilla 0.9.48 Yes
Application mozilla mozilla 1.0 Yes
Application mozilla mozilla 1.0 Yes
Application mozilla mozilla 1.0 Yes
Application mozilla mozilla 1.0 Yes
Application mozilla mozilla 1.0.1 Yes
Application mozilla mozilla 1.0.2 Yes
Application mozilla mozilla 1.1 Yes
Application mozilla mozilla 1.1 Yes
Application mozilla mozilla 1.1 Yes
Application mozilla mozilla 1.2 Yes
Application mozilla mozilla 1.2 Yes
Application mozilla mozilla 1.2 Yes
Application mozilla mozilla 1.2.1 Yes
Application mozilla mozilla 1.3 Yes
Application mozilla mozilla 1.3.1 Yes
Application mozilla mozilla 1.4 Yes
Application mozilla mozilla 1.4 Yes
Application mozilla mozilla 1.4 Yes
Application mozilla mozilla 1.4.1 Yes
Application mozilla mozilla 1.4.2 Yes
Application mozilla mozilla 1.4.4 Yes
Application mozilla mozilla 1.5 Yes
Application mozilla mozilla 1.5 Yes
Application mozilla mozilla 1.5 Yes
Application mozilla mozilla 1.5 Yes
Application mozilla mozilla 1.5.1 Yes
Application mozilla mozilla 1.6 Yes
Application mozilla mozilla 1.6 Yes
Application mozilla mozilla 1.6 Yes
Application mozilla seamonkey 1.1.17 Yes
References