CVE-2008-1234: mozilla firefox Cross-site Scripting

CVSS: 4.3v2.0MediumModified

Published 27-03-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-1234 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in mozilla firefox. EPSS estimates a 2.77% chance of exploitation in the next 30 days, higher than 86% of scored vulnerabilities.

Overall risk

18/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

2.77%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8

DSA-1532-1 DSA-1534-1 DSA-1534-2 DSA-1535-1 DSA-1574-1 RHSA-2008:0207+2 more

Timeline

27-03-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to inject arbitrary web script or HTML via event handlers, aka "Universal XSS using event handlers."

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

2.77%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

0.00 pp

From 2.77% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.77%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Mozilla3 products

firefox≤ 2.0.0.12
seamonkey≤ 1.1.8
thunderbird≤ 2.0.0.12

1 vendor · 3 products

References

51 links

www.securityfocus.com/archive/1/490196/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/29541Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29539Third Party AdvisoryX Refsource SECUNIA
www.mozilla.org/security/announce/2008/mfsa2008-14.htmlX Refsource CONFIRM
www.vupen.com/english/advisories/2008/0999/referencesVDB EntryX Refsource VUPEN
secunia.com/advisories/30620Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29560Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/41455VDB EntryX Refsource XF
www.debian.org/security/2008/dsa-1532Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/30327Third Party AdvisoryX Refsource SECUNIA

Show all 51 references

sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1Vendor AdvisoryX Refsource SUNALERT
www.ubuntu.com/usn/usn-592-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/29616Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1019694VDB EntryX Refsource SECTRACK
secunia.com/advisories/29550Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29645Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-605-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/29607Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1Vendor AdvisoryX Refsource SUNALERT
www.mandriva.com/security/advisories?name=MDVSA-2008:155Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2008/1793/referencesVDB EntryX Refsource VUPEN
www.debian.org/security/2008/dsa-1574Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/29558Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29548Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30370Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2008-0208.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/29526Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/2091/referencesVDB EntryX Refsource VUPEN
lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.htmlVendor AdvisoryX Refsource SUSE
www.us-cert.gov/cas/techalerts/TA08-087A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/29391Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30192Third Party AdvisoryX Refsource SECUNIA
www.kb.cert.org/vuls/id/466521Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.447313Vendor AdvisoryX Refsource SLACKWARE
www.redhat.com/support/errata/RHSA-2008-0209.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/bid/28448VDB EntryX Refsource BID
www.redhat.com/support/errata/RHSA-2008-0207.htmlVendor AdvisoryX Refsource REDHAT
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9551VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/30016Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1534Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/archives/fedora-package-announce/2008-May/msg00058.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/29547Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30105Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30094Third Party AdvisoryX Refsource SECUNIA
www.gentoo.org/security/en/glsa/glsa-200805-18.xmlVendor AdvisoryX Refsource GENTOO
wiki.rpath.com/wiki/Advisories:rPSA-2008-0128X Refsource CONFIRM
secunia.com/advisories/31043Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-May/msg00074.htmlVendor AdvisoryX Refsource FEDORA
www.vupen.com/english/advisories/2008/0998/referencesVDB EntryX Refsource VUPEN
www.debian.org/security/2008/dsa-1535Vendor AdvisoryX Refsource DEBIAN
www.mandriva.com/security/advisories?name=MDVSA-2008:080Vendor AdvisoryX Refsource MANDRIVA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities