{"schemaVersion":3,"id":"CVE-2008-4582","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.","dates":{"published":"2008-10-15T20:00:00.000Z","modified":"2024-08-07T10:24:19.339Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.10187,"percentile":0.95636,"severity":"medium","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.10187},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.10187,"percentile":0.95636}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.10187,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.10187,"percentile":0.95636}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"32466","name":"Mozilla Firefox 3.0.3 - Internet Shortcut Same Origin Policy Violation","source":"exploit-database","url":"https://www.exploit-db.com/exploits/32466","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/32466.html","codes":["CVE-2008-4582","OSVDB-49073"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-264","name":"Permissions, Privileges, and Access Controls","description":"Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.","type":"category","status":"Obsolete","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/264.html"}],"affected":[{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.06","noFixRecorded":false,"fixedIn":null},{"text":"7.10","noFixRecorded":false,"fixedIn":null},{"text":"8.04","noFixRecorded":false,"fixedIn":null},{"text":"8.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.06 | 7.10 | 8.04 | 8.10","eol":{"isEol":true,"eolDate":"2011-06-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"6.06","label":"6.06 'Dapper Drake' (LTS)","eolFrom":"2011-06-01T00:00:00.000Z","isLts":true,"isMaintained":false,"latestVersion":"6.06.2"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0","eol":{"isEol":true,"eolDate":"2010-02-15T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"4","label":"4 (Etch)","eolFrom":"2010-02-15T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"4.0r9"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.0.1","noFixRecorded":false,"fixedIn":null},{"text":"3.0.2","noFixRecorded":false,"fixedIn":null},{"text":"3.0.3","noFixRecorded":false,"fixedIn":null},{"text":"2.0","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0.1","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0.10","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0.11","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0.12","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0.13","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0.14","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0.15","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0.16","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.0.1 | 3.0.2 | 3.0.3 | 2.0 | 2.0.0.1 | 2.0.0.10 | 2.0.0.11 | 2.0.0.12 | 2.0.0.13 | 2.0.0.14 | 2.0.0.15 | 2.0.0.16 | 2.0.0.17","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"seamonkey","name":"seamonkey","label":"seamonkey","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.0","noFixRecorded":false,"fixedIn":null},{"text":"1.0:alpha","noFixRecorded":false,"fixedIn":null},{"text":"1.0:beta","noFixRecorded":false,"fixedIn":null},{"text":"1.0.1","noFixRecorded":false,"fixedIn":null},{"text":"1.0.2","noFixRecorded":false,"fixedIn":null},{"text":"1.0.3","noFixRecorded":false,"fixedIn":null},{"text":"1.0.4","noFixRecorded":false,"fixedIn":null},{"text":"1.0.5","noFixRecorded":false,"fixedIn":null},{"text":"1.0.6","noFixRecorded":false,"fixedIn":null},{"text":"1.0.7","noFixRecorded":false,"fixedIn":null},{"text":"1.0.8","noFixRecorded":false,"fixedIn":null},{"text":"1.0.9","noFixRecorded":false,"fixedIn":null},{"text":"1.1","noFixRecorded":false,"fixedIn":null},{"text":"1.1:alpha","noFixRecorded":false,"fixedIn":null},{"text":"1.1:beta","noFixRecorded":false,"fixedIn":null},{"text":"1.1.1","noFixRecorded":false,"fixedIn":null},{"text":"1.1.2","noFixRecorded":false,"fixedIn":null},{"text":"1.1.3","noFixRecorded":false,"fixedIn":null},{"text":"1.1.4","noFixRecorded":false,"fixedIn":null},{"text":"1.1.5","noFixRecorded":false,"fixedIn":null},{"text":"1.1.6","noFixRecorded":false,"fixedIn":null},{"text":"1.1.7","noFixRecorded":false,"fixedIn":null},{"text":"1.1.8","noFixRecorded":false,"fixedIn":null},{"text":"1.1.9","noFixRecorded":false,"fixedIn":null},{"text":"1.1.10","noFixRecorded":false,"fixedIn":null},{"text":"1.1.11","noFixRecorded":false,"fixedIn":null},{"text":"1.1.12","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.0 | 1.0:alpha | 1.0:beta | 1.0.1 | 1.0.2 | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.6 | 1.0.7 | 1.0.8 | 1.0.9 | 1.1 | 1.1:alpha | 1.1:beta | 1.1.1 | 1.1.2 | 1.1.3 | 1.1.4 | 1.1.5 | 1.1.6 | 1.1.7 | 1.1.8 | 1.1.9 | 1.1.10 | 1.1.11 | 1.1.12","eol":null,"hubHref":"/vendor/mozilla/seamonkey"}],"affectedCount":4,"eol":{"hasEol":true,"count":2},"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45740","label":"exchange.xforce.ibmcloud.com/vulnerabilities/45740","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.debian.org/security/2009/dsa-1697","label":"www.debian.org/security/2009/dsa-1697","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id?1021190","label":"www.securitytracker.com/id?1021190","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1671","label":"www.debian.org/security/2008/dsa-1671","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html","label":"www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","Not Applicable"]},{"url":"http://www.vupen.com/english/advisories/2009/0977","label":"www.vupen.com/english/advisories/2009/0977","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Not Applicable"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=455311","label":"bugzilla.mozilla.org/show_bug.cgi?id=455311","hostname":"bugzilla.mozilla.org","tags":["X Refsource MISC","Issue Tracking"]},{"url":"http://secunia.com/advisories/32192","label":"secunia.com/advisories/32192","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://www.mozilla.org/security/announce/2008/mfsa2008-47.html","label":"www.mozilla.org/security/announce/2008/mfsa2008-47.html","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://securitytracker.com/alerts/2008/Nov/1021212.html","label":"securitytracker.com/alerts/2008/Nov/1021212.html","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1669","label":"www.debian.org/security/2008/dsa-1669","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32778","label":"secunia.com/advisories/32778","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.html","label":"www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","Not Applicable"]},{"url":"http://secunia.com/advisories/33433","label":"secunia.com/advisories/33433","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://www.vupen.com/english/advisories/2008/2818","label":"www.vupen.com/english/advisories/2008/2818","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Not Applicable"]},{"url":"http://www.securityfocus.com/archive/1/497091/100/0/threaded","label":"www.securityfocus.com/archive/1/497091/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT","Broken Link"]},{"url":"http://securityreason.com/securityalert/4416","label":"securityreason.com/securityalert/4416","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]},{"url":"http://secunia.com/advisories/32721","label":"secunia.com/advisories/32721","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA08-319A.html","label":"www.us-cert.gov/cas/techalerts/TA08-319A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://secunia.com/advisories/32853","label":"secunia.com/advisories/32853","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://www.debian.org/security/2009/dsa-1696","label":"www.debian.org/security/2009/dsa-1696","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32693","label":"secunia.com/advisories/32693","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://secunia.com/advisories/32845","label":"secunia.com/advisories/32845","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://secunia.com/advisories/33434","label":"secunia.com/advisories/33434","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://secunia.com/advisories/32684","label":"secunia.com/advisories/32684","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://ubuntu.com/usn/usn-667-1","label":"ubuntu.com/usn/usn-667-1","hostname":"ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/31747","label":"www.securityfocus.com/bid/31747","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://liudieyu0.blog124.fc2.com/blog-entry-6.html","label":"liudieyu0.blog124.fc2.com/blog-entry-6.html","hostname":"liudieyu0.blog124.fc2.com","tags":["X Refsource MISC","Broken Link"]},{"url":"http://secunia.com/advisories/32714","label":"secunia.com/advisories/32714","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]},{"url":"http://www.securityfocus.com/bid/31611","label":"www.securityfocus.com/bid/31611","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://secunia.com/advisories/34501","label":"secunia.com/advisories/34501","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Permissions Required"]}],"lineage":{"upstream":[],"downstream":["DSA-1669-1","DSA-1671-1","DSA-1696-1","DSA-1697-1"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-10-15T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T10:24:19.339Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":29,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:46:47.427Z","stale":false,"partial":false}}