CVE-2009-3007 Other in n/a

Medium 4.3 Published 28 Aug 2009 Updated 7 Aug 2024

Attackers can spoof the browser address bar via window.open after a victim visits a local file, potentially misleading users about the current site.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2009-3007?

CVE-2009-3007 is a medium-severity vulnerability in Mozilla Firefox, published on 28 Aug 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1, allow context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker.

Which versions are affected by CVE-2009-3007?

It affects 3 products.

Products include Flock Flock, Mozilla Firefox, Mozilla Seamonkey.

How do I fix CVE-2009-3007?

Upgrade to a fixed version.

Is CVE-2009-3007 being exploited?

There is no known exploitation of CVE-2009-3007 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as GHSA-p7fh-hvqc-m963.