CVE-2007-5960: mozilla firefox Path Traversal

Vulnerability summary

CVE-2007-5960 is a medium (CVSS 4.3) Path Traversal vulnerability in mozilla firefox. EPSS estimates a 1.47% chance of exploitation in the next 30 days, higher than 73.3% of scored vulnerabilities.

Timeline

1. 26-11-2007
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.