Unscored severity · published Apr 6, 2007
CVE-2007-1878
Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.03 for Mozilla Firefox allows remote…
–
CVSS
5%
EPSS
No
On KEV
Description
Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.03 for Mozilla Firefox allows remote attackers to bypass zone restrictions, read arbitrary file:// URIs, or execute arbitrary code in the browser chrome, as demonstrated via the runFile function, related to lack of HTML escaping in the property name.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.0% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firebug · Parakey Inc.
1.01; 1.02 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1878
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1878
larholm.com
http://larholm.com/2007/04/06/0day-vulnerability-in-firebug/
Vendor Advisory
http://secunia.com/advisories/24743
securityreason.com
http://securityreason.com/securityalert/2525
Patch
http://www.getfirebug.com/blog/2007/04/04/security-update/
Exploit
http://www.gnucitizen.org/blog/firebug-goes-evil
www.securityfocus.com
http://www.securityfocus.com/archive/1/464740/100/0/threaded
More from Firebug
–
CVE-2007-1947
Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.04 for Mozilla Firefox allows remote…