CVE-2009-1311

Published: Apr 22, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17 allow user-assisted remote attackers to obtain sensitive information via a web page with an embedded frame, which causes POST data from an outer page to be sent to the inner frame's URL during a SAVEMODE_FILEONLY save of the inner frame.

Affected (132)

Products: Mozilla: Firefox, Seamonkey

Mozilla

2 products

Firefox

Seamonkey

Configuration A

132 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 3.0.8
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.1
Mozilla Firefox	Version 0.2
Mozilla Firefox	Version 0.3
Mozilla Firefox	Version 0.4
Mozilla Firefox	Version 0.5
Mozilla Firefox	Version 0.6.1
Mozilla Firefox	Version 0.6
Mozilla Firefox	Version 0.7.1
Mozilla Firefox	Version 0.7
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 0.9_rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.0 preview_release
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 1.8
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.12
Mozilla Firefox	Version 2.0.0.13
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16
Mozilla Firefox	Version 2.0.0.17
Mozilla Firefox	Version 2.0.0.18
Mozilla Firefox	Version 2.0.0.19
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.20
Mozilla Firefox	Version 2.0.0.21
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta1
Mozilla Firefox	Version 2.0 beta_1
Mozilla Firefox	Version 2.0 rc2
Mozilla Firefox	Version 2.0 rc3
Mozilla Firefox	Version 2.0_.10
Mozilla Firefox	Version 2.0_.1
Mozilla Firefox	Version 2.0_.4
Mozilla Firefox	Version 2.0_.5
Mozilla Firefox	Version 2.0_.6
Mozilla Firefox	Version 2.0_.7
Mozilla Firefox	Version 2.0_.9
Mozilla Firefox	Version 2.0_8
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0.6
Mozilla Firefox	Version 3.0.7
Mozilla Firefox	Version 3.0
Mozilla Firefox	Version 3.0 alpha
Mozilla Firefox	Version 3.0 beta2
Mozilla Firefox	Version 3.0 beta5
Mozilla Seamonkey	Up to 1.1.16
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.99
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.13
Mozilla Seamonkey	Version 1.1.14
Mozilla Seamonkey	Version 1.1.15
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.5 1.1.10
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 alpha
Mozilla Seamonkey	Version 1.1 beta
Mozilla Seamonkey	Version 1.5.0.10

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (56)

http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2009-0437.html

Source: secalert@redhat.com

http://secunia.com/advisories/34758

Source: secalert@redhat.com

http://secunia.com/advisories/34843

Source: secalert@redhat.com

http://secunia.com/advisories/34844

Source: secalert@redhat.com

http://secunia.com/advisories/34894

Source: secalert@redhat.com

http://secunia.com/advisories/35042

Source: secalert@redhat.com

http://secunia.com/advisories/35065

Source: secalert@redhat.com

http://secunia.com/advisories/35561

Source: secalert@redhat.com

http://secunia.com/advisories/35882

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1797

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:111

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2009/mfsa2009-21.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2009-0436.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/34656

Source: secalert@redhat.com

http://www.securitytracker.com/id?1022097

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/1125

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=471962

Source: secalert@redhat.com

Exploit

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10939

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6200

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6222

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7235

Source: secalert@redhat.com

https://usn.ubuntu.com/764-1/

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00683.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00444.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00504.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html