CVE-2016-2825: Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL

Medium severity · published Jun 13, 2016

CVE-2016-2825

Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL

6.5

CVSS

1.7%

EPSS

On KEV

Description

Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.7% · higher than 77% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Firefox · Mozilla

through 46.0.1 · source: NVD

Leap · Opensuse

42.1 · source: NVD

Opensuse · Opensuse

13.1; 13.2 · source: NVD

Ubuntu Linux · Canonical

12.04; 14.04; 15.10; 16.04 · source: NVD

Affected product

Firefox

Mozilla

All Firefox CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-2825

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-2825

lists.opensuse.org

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html

lists.opensuse.org

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html

Vendor Advisory

http://www.mozilla.org/security/announce/2016/mfsa2016-54.html

www.securitytracker.com

http://www.securitytracker.com/id/1036057

www.ubuntu.com

http://www.ubuntu.com/usn/USN-2993-1

bugzilla.mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1193093