CVE-2009-3010 Cross-site scripting in n/a
Remote attackers can execute arbitrary JavaScript via crafted data URIs in HTTP Refresh headers, enabling cross-site scripting attacks against browser users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2009-3010?
CVE-2009-3010 is a medium-severity cross-site scripting vulnerability in Mozilla Firefox, published on 31 Aug 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header. NOTE: in some product versions, the JavaScript executes outside of the context of the HTTP site.
Weakness: CWE-79
Which versions are affected by CVE-2009-3010?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Mozilla, Mozilla Seamonkey.
How do I fix CVE-2009-3010?
No fix has been published for CVE-2009-3010 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2009-3010 being exploited?
There is no known exploitation of CVE-2009-3010 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-mv6q-6xwq-rrw9.