CVE-2008-0415: mozilla firefox Cross-site Scripting

CVSS: 4.3v2.0MediumModified

Published 08-02-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-0415 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in mozilla firefox. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.2% of scored vulnerabilities.

Overall risk

18/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

2.21%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 2

DSA-1484-1 DSA-1485-2 DSA-1489-1 DSA-1506-1 OPENSUSE-SU-2024:10600-1 OPENSUSE-SU-2024:14572-1+3 more

Timeline

08-02-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to execute script outside of the sandbox and conduct cross-site scripting (XSS) attacks via multiple vectors including the XMLDocument.load function, aka "JavaScript privilege escalation bugs."

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

2.21%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

0.00 pp

From 2.21% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Mozilla3 products

firefox≤ 2.0.0.11
seamonkey≤ 1.1.7
thunderbird≤ 2.0.0.11

1 vendor · 3 products

References

65 links

www.redhat.com/support/errata/RHSA-2008-0104.htmlVendor AdvisoryX Refsource REDHAT
www.ubuntu.com/usn/usn-582-2Vendor AdvisoryX Refsource UBUNTU
www.ubuntu.com/usn/usn-576-1Vendor AdvisoryX Refsource UBUNTU
browser.netscape.com/releasenotes/X Refsource CONFIRM
secunia.com/advisories/28939Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1506Vendor AdvisoryX Refsource DEBIAN
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.445399Vendor AdvisoryX Refsource SLACKWARE
issues.rpath.com/browse/RPL-1995X Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2008-February/msg00946.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/archives/fedora-package-announce/2008-February/msg00905.htmlVendor AdvisoryX Refsource FEDORA

Show all 65 references

wiki.rpath.com/wiki/Advisories:rPSA-2008-0093X Refsource CONFIRM
secunia.com/advisories/28766Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28818Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30620Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28865Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29049Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0453/referencesVDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2008-0103.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/28877Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28879Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-582-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/29167Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29567Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0105.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/28958Third Party AdvisoryX Refsource SECUNIA
support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.htmlX Refsource CONFIRM
secunia.com/advisories/30327Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1Vendor AdvisoryX Refsource SUNALERT
www.securityfocus.com/archive/1/488971/100/0/threadedMailing ListX Refsource BUGTRAQ
www.debian.org/security/2008/dsa-1489Vendor AdvisoryX Refsource DEBIAN
www.securityfocus.com/archive/1/488002/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/487826/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/29086Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28815Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0454/referencesVDB EntryX Refsource VUPEN
sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/28864Third Party AdvisoryX Refsource SECUNIA
bugzilla.mozilla.org/buglist.cgi?bug_id=386695%2C393761%2C393762%2C399298%2C407289%2C372075%2C363597X Refsource CONFIRM
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9897VDB EntrySignatureX Refsource OVAL
www.debian.org/security/2008/dsa-1485Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/28924Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/27683VDB EntryX Refsource BID
www.vupen.com/english/advisories/2008/1793/referencesVDB EntryX Refsource VUPEN
www.mozilla.org/security/announce/2008/mfsa2008-03.htmlX Refsource CONFIRM
www.securitytracker.com/id?1019327VDB EntryX Refsource SECTRACK
wiki.rpath.com/Advisories:rPSA-2008-0093X Refsource CONFIRM
www.vupen.com/english/advisories/2008/2091/referencesVDB EntryX Refsource VUPEN
lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.htmlVendor AdvisoryX Refsource SUSE
www.redhat.com/archives/fedora-package-announce/2008-February/msg00309.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/29164Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29211Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.htmlVendor AdvisoryX Refsource FEDORA
wiki.rpath.com/Advisories:rPSA-2008-0051X Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2008:062Vendor AdvisoryX Refsource MANDRIVA
www.debian.org/security/2008/dsa-1484Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/28808Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0627/referencesVDB EntryX Refsource VUPEN
www.gentoo.org/security/en/glsa/glsa-200805-18.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/28754Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28758Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.htmlVendor AdvisoryX Refsource FEDORA
www.mandriva.com/security/advisories?name=MDVSA-2008:048Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/31043Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29098Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28839Third Party AdvisoryX Refsource SECUNIA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities