CVE-2006-4561

Status: ModifiedHigh (7.5)—

Mozilla Firefox 1.5.0.6 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running.

CVSS

Version: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Base score: 7.5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.53%
Percentile among all scored CVEs: 74
Score date: 10/14/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Mozilla — Firefox

CWEs

NVD-CWE-Other

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2006-4561",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-09-06T00:04:00.000",
  "references": [
    {
      "url": "http://osvdb.org/31834",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://polyboy.net/xss/dnsslurp.html",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://shampoo.antville.org/stories/1451301/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/443209/100/200/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/31834",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://polyboy.net/xss/dnsslurp.html",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://shampoo.antville.org/stories/1451301/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/443209/100/200/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox 1.5.0.6 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running."
    },
    {
      "lang": "es",
      "value": "Mozilla Firefox 1.5.0.6 permite a un atacante remoto ejecutar código JavaScript de su elección  en el contexto de una sesión del navegador con un servidor web de intranet de su elección, a través de la secuencia de comandos del alojamiento sobre un servidor web de Internet que puede hace inaccesible a través del ataque y que tiene un nombre de dominio bajo el cotrol del atacante, lo cuál puede forzar al navegador reducir el DNS que fija y realizar una nueva pregunta al DNS para el nombre de dominio después de que la secuencia de comandos esté ya funcionando."
    }
  ],
  "lastModified": "2026-06-16T22:29:20.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE8E5194-7B34-4802-BDA6-6A86EB5EDE05"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}