« Volver al listado

CVE-2014-1552

Estado: ModificadaMedia (5.8)—

Mozilla Firefox anterior a 31.0 y Thunderbird anterior a 31.0 no implementa debidamente el atributo sandbox del elemento IFRAME, lo que permite a atacantes remotos evadir las restricciones en el contenido del mismo origen a través de un sitio web manipulado en conjunto con una redirección.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Mozilla — FirefoxMozilla — Thunderbird

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-1552",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-07-23T11:12:43.090",
  "references": [
    {
      "url": "http://secunia.com/advisories/59760",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/60628",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-66.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1030619",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1030620",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=985135",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/59760",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/60628",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-66.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1030619",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1030620",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=985135",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox before 31.0 and Thunderbird before 31.0 do not properly implement the sandbox attribute of the IFRAME element, which allows remote attackers to bypass intended restrictions on same-origin content via a crafted web site in conjunction with a redirect."
    },
    {
      "lang": "es",
      "value": "Mozilla Firefox anterior a 31.0 y Thunderbird anterior a 31.0 no implementa debidamente el atributo sandbox del elemento IFRAME, lo que permite a atacantes remotos evadir las restricciones en el contenido del mismo origen a través de un sitio web manipulado en conjunto con una redirección."
    }
  ],
  "lastModified": "2026-06-17T00:05:08.663",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3BD70C79-7EA7-49CB-B3D6-6C77E0C55BB4",
              "versionEndIncluding": "30.0"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "356BAADA-819E-44B8-A3B0-BE53059C3F8D",
              "versionEndIncluding": "24.7"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CCAFDF1-10BB-4AB0-9C9D-E99DDBA901BB"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31EE89B8-705F-4A05-9015-3D6E81D394E9"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E30AE3D4-6A3E-435E-BDBF-1A9A17297433"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0C705A0-62C0-485A-A077-C7DD426F80B5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66C802A7-E4D5-4D2D-9CE8-749A75DF7461"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E8A57FA-AC27-4288-8E42-97DECF3B993C"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D474B11-98D0-41A3-A98B-CFB6955264AE"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BBD940E-9EF0-460B-A721-E70C719F2244"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "063FC215-D9D2-40D0-A8A5-6289890EF9B3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}