CVE-2008-2933 Path traversal in n/a
Remote attackers can read arbitrary local files or access chrome URIs by exploiting pipe character handling in command-line URIs, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2008-2933?
CVE-2008-2933 is a low-severity path traversal vulnerability in Mozilla Firefox, published on 17 Jul 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' (pipe) characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely handled by a vector application, as exploited in conjunction with CVE-2008-2540. NOTE: this issue exists because of an insufficient fix for CVE-2005-2267.
Weakness: CWE-20
Which versions are affected by CVE-2008-2933?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2008-2933?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2008-2933 being exploited?
There is no known exploitation of CVE-2008-2933 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-9wm7-g493-2j99.