« Volver al listado

CVE-2003-0594

Estado: ModificadaAlta (7.5)—

Mozilla permite a atacantes remotos saltarse las restriciones de cookies pretendidas en una aplicación web mediante secuencias de atravesamiento de directorios "%2e%2e" (punto punto codificado) en una URL, lo que hace que Mozilla envíe la cookie fuera de los subconjuntos de URL especificados, por ejemplo a una aplicación vulnerable que corre en el mismo servidor que la aplicación objetivo.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mozilla — Mozilla

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2003-0594",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2004-04-15T04:00:00.000",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:021",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2004-112.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A873",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A917",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9826",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:021",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2004-112.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A873",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A917",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9826",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via \"%2e%2e\" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application."
    },
    {
      "lang": "es",
      "value": "Mozilla permite a atacantes remotos saltarse las restriciones de cookies pretendidas en una aplicación web mediante secuencias de atravesamiento de directorios \"%2e%2e\" (punto punto codificado) en una URL, lo que hace que Mozilla envíe la cookie fuera de los subconjuntos de URL especificados, por ejemplo a una aplicación vulnerable que corre en el mismo servidor que la aplicación objetivo."
    }
  ],
  "lastModified": "2026-06-16T22:02:29.307",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCDAEAE6-BA9F-4D40-B264-4A72930239E1"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9296197-0EE0-4CC0-A11F-E44E3443E990"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A76ACC55-754D-4501-8312-5A4E10D053B8"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8987151-0901-4547-B750-5DC470BB9CF7"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53E60BCC-6D1C-489E-9F3B-9BE42B46704F"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66A87ED8-9E1F-4C2C-B806-A41765081C9C"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.1:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C795D86F-9B08-41FE-B82B-5BBB3DE6357D"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.1:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2637D552-4A3D-4867-B52A-ACCED8681AF4"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CC237C8-CFE0-4128-B549-93CD16894E71"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.2:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B8EA79A-8426-44CF-AF13-58F7EF8B6D88"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.2:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "367A5D46-0FF3-4140-9478-251363822E9C"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAA58EE9-05C7-4395-A8A4-5F54BE4C5DAD"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C656A621-BE62-4BB8-9B25-A3916E60FA12"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8DE4889-424F-4A44-8C14-9F18821CE961"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D3F91A1-7DD9-4146-8BA4-BE594C66DD30"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED69BEB9-8D83-415B-826D-9D17FB67976B"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:1.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AE678D7-812D-4C55-91B0-F3AC6BE0CD58"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}