CVE-2011-2370 Security feature bypass in n/a

Medium 5.0 Published 30 Jun 2011 Updated 6 Aug 2024

Remote attackers can bypass Firefox's installation whitelist to trigger add-on or theme installation dialogs, requiring user interaction to complete.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2011-2370?

CVE-2011-2370 is a medium-severity vulnerability in Mozilla Firefox, published on 30 Jun 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.

Weakness: CWE-264

Which versions are affected by CVE-2011-2370?

It affects 1 product.

Products include Mozilla Firefox.

How do I fix CVE-2011-2370?

Upgrade to a fixed version.

Is CVE-2011-2370 being exploited?

There is no known exploitation of CVE-2011-2370 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as GHSA-q4f3-7m9m-fpqf.