CVE-2009-3385
Estado: ModificadaAlta (7.1)—
The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as demonstrated by a Flash object that sends arbitrary local files during a reply or forward operation.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:C/I:N/A:N
- Puntuación base: 7.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.77%
- Percentil entre todas las CVEs puntuadas: 86
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-264
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
- http://secunia.com/advisories/39001
- http://www.mozilla.org/security/announce/2010/mfsa2010-06.html
- http://www.securityfocus.com/bid/38830
- http://www.vupen.com/english/advisories/2010/0648
- https://bugzilla.mozilla.org/show_bug.cgi?id=371976
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10271
- http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
- http://secunia.com/advisories/39001
- http://www.mozilla.org/security/announce/2010/mfsa2010-06.html
- http://www.securityfocus.com/bid/38830
- http://www.vupen.com/english/advisories/2010/0648
- https://bugzilla.mozilla.org/show_bug.cgi?id=371976
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10271
JSON original (NVD)
Mostrar
{
"id": "CVE-2009-3385",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.1,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 6.9,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2010-03-23T00:53:22.113",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/39001",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.mozilla.org/security/announce/2010/mfsa2010-06.html",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/38830",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2010/0648",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=371976",
"source": "cve@mitre.org"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10271",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/39001",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mozilla.org/security/announce/2010/mfsa2010-06.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/38830",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2010/0648",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=371976",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10271",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as demonstrated by a Flash object that sends arbitrary local files during a reply or forward operation."
},
{
"lang": "es",
"value": "El componente mail en Mozilla SeaMonkey anteriores a v1.1.19 no restringe de forma adecuada la ejecuc´ión de contenidos de plugin ejecutable, lo que permite a usuarios asistidos por atacantes remotos obtener información sensible a través de contenido manipulado en un elemento IFRAME en un mensaje de correo HTML, como se demostró mediante un objeto Flash que enviaba ficheros locales de su elección mientras se ejecutaba una acción de avance o retroceso."
}
],
"lastModified": "2026-06-16T23:11:30.593",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "259CE19E-494D-491B-8945-B8770E27F940",
"versionEndIncluding": "1.1.18"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09E18FC0-0C8C-4FA1-85B9-B868D00F002F"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A97B6E1-EABA-4977-A3FC-64DF0392AA95"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB01A97F-ACE1-4A99-8939-6DF8FE5B5E8E"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6521C877-63C9-4B6E-9FC9-1263FFBB7950"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D949DF0A-CBC2-40E1-AE6C-60E6F58D2481"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C5CDA57-1A50-4EDB-80E2-D3EBB44EA653"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22D33486-4956-4E2C-BA16-FA269A9D02BD"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3104343E-93B6-4D4A-BC95-ED9F7E91FB6A"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "381313EF-DF84-4F66-9962-DE8F45029D79"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0228476-14E4-443C-BBAE-2C9CD8594DC0"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A803A500-DCE2-44FC-ABEB-A90A1D39D85C"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "022274DE-5251-49C9-B6E5-1D8CEDC34E7D"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9F84CB7-93F7-4912-BC87-497867B96491"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8992E9C6-09B3-492E-B7DA-899D5238EC18"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D58B704B-F06E-44C1-BBD1-A090D1E6583A"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40270FBD-744A-49D9-9FFA-1DCD897210D7"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "20E01097-F60A-4FB2-BA47-84A267EE87D6"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F65732F-317B-49A2-B9B0-FA1102B8B45C"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB430F19-069A-43FD-9097-586D4449D327"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76AD0439-3BFB-4AD1-8E2C-99D0B099FA8C"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E6D7528-E591-48A6-8165-BE42F8EBF6B6"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA710423-0075-44B8-9DCB-6380FA974486"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C5521DA3-E6AF-4350-B971-10B4A1C9B1D1"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DDD15752-A253-47B1-BCE0-B55B84B47C9F"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "60B39A9D-44A4-4D7F-9004-C44066BBE277"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F203EC52-2126-4227-AF3B-23857E5BB222"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E951567B-8402-42EA-AE33-EBA9235A868F"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82A94198-7EBF-4D8A-A99A-A32A8561FF2F"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1BFFBC58-ACD2-449D-B010-5026D6022F86"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83EED5D2-EC40-4253-991B-0C746FBEF6A5"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F73092C-1458-4278-A30D-C0F89B1F82F6"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AAB559BD-4BF7-417F-962F-B8971FF1614B"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}