CVE-2008-5022: canonical ubuntu_linux Improper Authentication

CVSS: 7.5v2.0HighModified

Published 13-11-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-5022 is a high (CVSS 7.5) Improper Authentication vulnerability in canonical ubuntu_linux. EPSS estimates a 3.03% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

3.03%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 1

DSA-1669-1 DSA-1671-1 DSA-1696-1 DSA-1697-1 OPENSUSE-SU-2024:10601-1 RHSA-2008:0976+2 more

Timeline

13-11-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

3.03%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

0.00 pp

From 3.03% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.03%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected systems

Mozilla3 products

firefox≥ 2.0, < 2.0.0.18 | ≥ 3.0, < 3.0.4
seamonkey≥ 1.0, < 1.1.13
thunderbird≥ 2.0, < 2.0.0.18

Canonical1 product

ubuntu_linuxEOL6.06 | 7.10 | 8.04 | 8.10

Debian1 product

debian_linuxEOL4.0

3 vendors · 5 products

References

38 links

www.vupen.com/english/advisories/2008/3146VDB EntryX Refsource VUPENThird Party Advisory
www.mozilla.org/security/announce/2008/mfsa2008-56.htmlX Refsource CONFIRMVendor Advisory
www.debian.org/security/2009/dsa-1697Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.debian.org/security/2008/dsa-1671Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/bid/32281VDB EntryX Refsource BIDThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/32713Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0977.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:230Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
www.vupen.com/english/advisories/2009/0977VDB EntryX Refsource VUPENThird Party Advisory

Show all 38 references

secunia.com/advisories/32695Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0978.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.debian.org/security/2008/dsa-1669Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/32778Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0976.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/33433Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11186VDB EntrySignatureX Refsource OVALThird Party Advisory
sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Vendor AdvisoryX Refsource SUNALERTBroken Link
lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
secunia.com/advisories/32694Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1021188VDB EntryX Refsource SECTRACKThird Party Advisory
secunia.com/advisories/32721Third Party AdvisoryX Refsource SECUNIA
www.us-cert.gov/cas/techalerts/TA08-319A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
bugzilla.mozilla.org/show_bug.cgi?id=460002X Refsource MISCIssue TrackingVendor Advisory
secunia.com/advisories/32853Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2009/dsa-1696Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/32715Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32693Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:228Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
secunia.com/advisories/32845Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:235Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
secunia.com/advisories/33434Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32798Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32684Third Party AdvisoryX Refsource SECUNIA
ubuntu.com/usn/usn-667-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/32714Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/34501Third Party AdvisoryX Refsource SECUNIA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities