« Volver al listado

CVE-2010-0170

Estado: ModificadaMedia (4.3)—

Mozilla Firefox v3.6 anterior a v3.6.2 no ofrece a las extensiones el mecanismo de protección window.location, lo que permite a atacantes remotos evitar la política de "Same Origin" y dirigir ataques de secuencias de comandos en sitios cruzados (XSS) a traves de vectores que son específicos para cada plugin afectado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mozilla — Firefox

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-0170",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-03-25T21:00:00.563",
  "references": [
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:070",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2010/mfsa2010-10.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/38918",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/38919",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0692",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=541530",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8602",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:070",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2010/mfsa2010-10.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/38918",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/38919",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0692",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=541530",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8602",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin."
    },
    {
      "lang": "es",
      "value": "Mozilla Firefox v3.6 anterior a v3.6.2 no ofrece a las extensiones el mecanismo de protección window.location, lo que permite a atacantes remotos evitar la política de \"Same Origin\" y dirigir ataques de secuencias de comandos en sitios cruzados (XSS) a traves de vectores que son específicos para cada plugin afectado."
    }
  ],
  "lastModified": "2026-06-16T23:15:37.133",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3782354-7EB7-49D2-B240-1871F6CB84C7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}