CVE-2010-0172
toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might…
Does this matter?
Lower severity and a low EPSS score (1.41%). Track it; it rarely justifies an emergency change on its own.
Description
toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to spoof an authorization dialog and capture credentials by demanding HTTP authentication in opportunistic circumstances.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 1.41% probability · 71th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox
- Source
- cve@mitre.org
References
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:070
- http://www.mozilla.org/security/announce/2010/mfsa2010-15.htmlPatch
- http://www.securityfocus.com/bid/38918
- http://www.vupen.com/english/advisories/2010/0692
- https://bugzilla.mozilla.org/show_bug.cgi?id=537862
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8281
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:070
- http://www.mozilla.org/security/announce/2010/mfsa2010-15.htmlPatch
- http://www.securityfocus.com/bid/38918
- http://www.vupen.com/english/advisories/2010/0692
- https://bugzilla.mozilla.org/show_bug.cgi?id=537862
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8281
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.