CVE-2008-0418: mozilla firefox Path Traversal

CVSS: 4.3v2.0MediumModified

Published 08-02-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-0418 is a medium (CVSS 4.3) Path Traversal vulnerability in mozilla firefox. EPSS estimates a 8.63% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

29/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

8.63%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 9 · Related 2

DSA-1484-1 DSA-1485-2 DSA-1489-1 DSA-1506-1 OPENSUSE-SU-2024:10600-1 OPENSUSE-SU-2024:14572-1+3 more

Timeline

08-02-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

8.63%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.63% on 19-09-2026

19-09-202619-10-2026

EPSS score

8.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databaseremotelinuxVerified
Mozilla Firefox 2.0 - 'chrome://' URI JavaScript File Request Information Disclosure
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Mozilla3 products

firefox≤ 2.0.0.11
seamonkey≤ 1.1.7
thunderbird≤ 2.0.0.11

1 vendor · 3 products

References

67 links

www.redhat.com/support/errata/RHSA-2008-0104.htmlVendor AdvisoryX Refsource REDHAT
www.ubuntu.com/usn/usn-582-2Vendor AdvisoryX Refsource UBUNTU
www.securitytracker.com/id?1019329VDB EntryX Refsource SECTRACK
www.ubuntu.com/usn/usn-576-1Vendor AdvisoryX Refsource UBUNTU
browser.netscape.com/releasenotes/X Refsource CONFIRM
secunia.com/advisories/28939Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1506Vendor AdvisoryX Refsource DEBIAN
www.kb.cert.org/vuls/id/309608Third Party AdvisoryX Refsource CERT VNUS Government Resource
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.445399Vendor AdvisoryX Refsource SLACKWARE
issues.rpath.com/browse/RPL-1995X Refsource CONFIRM

Show all 67 references

www.redhat.com/archives/fedora-package-announce/2008-February/msg00946.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/archives/fedora-package-announce/2008-February/msg00905.htmlVendor AdvisoryX Refsource FEDORA
wiki.rpath.com/wiki/Advisories:rPSA-2008-0093X Refsource CONFIRM
secunia.com/advisories/28766Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28622/Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28818Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30620Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28865Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29049Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0453/referencesVDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2008-0103.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/28877Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28879Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-582-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/29167Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29567Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0105.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/28958Third Party AdvisoryX Refsource SECUNIA
support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.htmlX Refsource CONFIRM
secunia.com/advisories/30327Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1Vendor AdvisoryX Refsource SUNALERT
www.securityfocus.com/archive/1/488971/100/0/threadedMailing ListX Refsource BUGTRAQ
www.debian.org/security/2008/dsa-1489Vendor AdvisoryX Refsource DEBIAN
www.mozilla.org/security/announce/2008/mfsa2008-05.htmlX Refsource CONFIRM
www.securityfocus.com/archive/1/488002/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/487826/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/29086Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28815Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0454/referencesVDB EntryX Refsource VUPEN
sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/28864Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1485Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/28924Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/1793/referencesVDB EntryX Refsource VUPEN
wiki.rpath.com/Advisories:rPSA-2008-0093X Refsource CONFIRM
www.vupen.com/english/advisories/2008/2091/referencesVDB EntryX Refsource VUPEN
lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.htmlVendor AdvisoryX Refsource SUSE
www.redhat.com/archives/fedora-package-announce/2008-February/msg00309.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/29164Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29211Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.htmlVendor AdvisoryX Refsource FEDORA
wiki.rpath.com/Advisories:rPSA-2008-0051X Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2008:062Vendor AdvisoryX Refsource MANDRIVA
www.debian.org/security/2008/dsa-1484Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/28808Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0263VDB EntryX Refsource VUPEN
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10705VDB EntrySignatureX Refsource OVAL
www.vupen.com/english/advisories/2008/0627/referencesVDB EntryX Refsource VUPEN
www.gentoo.org/security/en/glsa/glsa-200805-18.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/28754Third Party AdvisoryX Refsource SECUNIA
www.hiredhacker.com/2008/01/19/firefox-chrome-url-handling-directory-traversal/X Refsource MISC
www.securityfocus.com/bid/27406VDB EntryX Refsource BID
www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.htmlVendor AdvisoryX Refsource FEDORA
www.mandriva.com/security/advisories?name=MDVSA-2008:048Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/31043Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29098Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28839Third Party AdvisoryX Refsource SECUNIA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities