CVE-2010-1215

EUVD-2010-1245 · Published Jul 30, 2010

Mozilla Firefox 3.6.x before 3.6.7 and Thunderbird 3.1.x before 3.1.1 do not properly implement access to a content object through a SafeJSObjectWrapper (aka SJOW) wrapper, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging "access to an object from the chrome scope."

Technologies

Mozilla ThunderbirdMozilla Firefox

Weaknesses

CWE-94

CVSS scores

v2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Stealth

T1190Exploit Public-Facing Application T1027.006HTML Smuggling T1027.009Embedded Payloads T1564.009Resource Forking

References

http://www.mozilla.org/security/announce/2010/mfsa2010-38.html
https://bugzilla.mozilla.org/show_bug.cgi?id=567069
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11527

Potentially impacted assets

See if this affects your attack surface