Vulnerabilities > CVE-2007-1084 - Configuration vulnerability in Mozilla Firefox
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0490.html
- http://lcamtuf.coredump.cx/ffbook
- http://lcamtuf.coredump.cx/ffbook/
- http://osvdb.org/33803
- http://securityreason.com/securityalert/2304
- http://www.heise-security.co.uk/news/85728
- http://www.securityfocus.com/archive/1/460885/100/0/threaded
- http://www.securityfocus.com/archive/1/460890/100/0/threaded
- http://www.securityfocus.com/archive/1/460896/100/0/threaded
- http://www.securityfocus.com/archive/1/461021/100/0/threaded
- http://www.securityfocus.com/bid/22666
- https://bugzilla.mozilla.org/show_bug.cgi?id=371179