SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2012-1956

Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 do not prevent use of the Object.defineProperty method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site…

MEDIUM 4.3EPSS 1.89%

Does this matter?

Lower severity and a low EPSS score (1.89%). Track it; it rarely justifies an emergency change on its own.

Description

Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 do not prevent use of the Object.defineProperty method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.

CVSS 2.0
4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
1.89% probability · 78th percentile
CISA KEV
Not listed
Weakness
CWE-79
Affected
mozilla/firefox · mozilla/thunderbird · mozilla/seamonkey
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.