CVE-2006-6077
The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches…
Does this matter?
Lower severity and a low EPSS score (2.01%). Track it; it rarely justifies an emergency change on its own.
Description
The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a password, which allows remote attackers to obtain passwords via a password INPUT element on a different web page located on the web site intended for this password.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.01% probability · 80th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox · netscape/navigator
- Source
- cve@mitre.org
References
- ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc
- ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc
- http://fedoranews.org/cms/node/2713
- http://fedoranews.org/cms/node/2728
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
- http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
- http://rhn.redhat.com/errata/RHSA-2007-0077.html
- http://secunia.com/advisories/23046Exploit, Vendor Advisory
- http://secunia.com/advisories/23108
- http://secunia.com/advisories/24205
- http://secunia.com/advisories/24238
- http://secunia.com/advisories/24287
- http://secunia.com/advisories/24290
- http://secunia.com/advisories/24293
- http://secunia.com/advisories/24320
- http://secunia.com/advisories/24328
- http://secunia.com/advisories/24333
- http://secunia.com/advisories/24342
- http://secunia.com/advisories/24343
- http://secunia.com/advisories/24384
- http://secunia.com/advisories/24393
- http://secunia.com/advisories/24395
- http://secunia.com/advisories/24437
- http://secunia.com/advisories/24457
- http://secunia.com/advisories/24650
- http://secunia.com/advisories/25588
- http://security.gentoo.org/glsa/glsa-200703-04.xml
- http://securitytracker.com/id?1017271Exploit
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
- http://www.debian.org/security/2007/dsa-1336
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.