Unscored severity · published Apr 11, 2007
CVE-2007-1947
Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.04 for Mozilla Firefox allows remote…
–
CVSS
4.5%
EPSS
No
On KEV
Description
Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.04 for Mozilla Firefox allows remote attackers to bypass zone restrictions, read arbitrary file:// URIs, or execute arbitrary code in the browser chrome by overwriting the toString function via a certain function declaration, related to incorrect identification of anonymous JavaScript functions, a different issue than CVE-2007-1878.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firebug · Parakey Inc.
through 1.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1947
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1947
Vendor Advisory
http://larholm.com/2007/04/06/more-0day-in-firebug/
Patch
http://larholm.com/2007/04/06/more-0day-in-firebug/#comment-6
www.securityfocus.com
http://www.securityfocus.com/archive/1/464875/100/0/threaded
More from Firebug
–
CVE-2007-1878
Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.03 for Mozilla Firefox allows remote…