CVE-2009-0358

Status: ModifiedLow (3.3)—
Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
CVSS

Version: 2.0
Vector: AV:A/AC:L/Au:N/C:P/I:N/A:N
Base score: 3.3
Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.52%
Percentile among all scored CVEs: 43
Score date: 10/14/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)

Mozilla — Firefox
CWEs

CWE-200
References

Raw JSON (NVD)

Show
{
  "id": "CVE-2009-0358",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.3,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-02-04T19:30:00.517",
  "references": [
    {
      "url": "http://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspx",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/33799",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/33809",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/33831",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/33841",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/33846",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/33869",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-06.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/33598",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1021667",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-717-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/0313",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=441751",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10610",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspx",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/33799",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/33809",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/33831",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/33841",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/33846",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/33869",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-06.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/33598",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1021667",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-717-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/0313",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=441751",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10610",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request."
    },
    {
      "lang": "es",
      "value": "Mozilla Firefox 3.x anterior a 3.0.6 no implementa adecuadamente las directivas de (1) no-store y (2) no-cache Cache-Control, lo que permite a usuarios locales obtener información sensible usando el (1) botón volver o el (2) historial del navegador de la víctima, como se ha demostrado mediante la lectura de la página de respuesta de una petición http POST."
    }
  ],
  "lastModified": "2026-06-16T23:04:51.433",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "412DF091-7604-4110-87A0-3488116A97E5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A1DE6AC-C6AA-4B27-AC21-3293E5357A7E"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13AAF607-AEEE-4FAF-BE63-73B1D951EF52"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20139741-10B1-4E4B-8D5F-A715042049C4"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11E07FED-ABDB-4B0A-AB2E-4CBF1EAC4301"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A6558F1-9E0D-4107-909A-8EF4BC8A9C2F"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63DF3D65-C992-44CF-89B4-893526C6242E"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9024117-2E8B-4240-9E21-CC501F3879B5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBC3CAD3-2F54-4E32-A0C9-0D826C45AC23"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}