CVE-2010-0172 Security feature bypass in n/a
Remote attackers can spoof authorization dialogs in Firefox to capture user credentials by exploiting concurrent authentication request handling flaws.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2010-0172?
CVE-2010-0172 is a medium-severity vulnerability in Mozilla Firefox, published on 25 Mar 2010. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to spoof an authorization dialog and capture credentials by demanding HTTP authentication in opportunistic circumstances.
Which versions are affected by CVE-2010-0172?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2010-0172?
Upgrade to a fixed version.
Is CVE-2010-0172 being exploited?
There is no known exploitation of CVE-2010-0172 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-34rw-q4gp-cwxm.