CVE-2008-0418 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 8.6% (pctl 95)
Patch early
A public exploit exists.
Description
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| EPSS | 8.63% — more likely to be exploited than 95% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2008-02-08 |
| Last modified | 2026-06-16 |
Affected (3)
| Vendor | Product |
|---|---|
| mozilla | firefox |
| mozilla | seamonkey |
| mozilla | thunderbird |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Mozilla Firefox 2.0 - 'chrome://' URI JavaScript File Request Information Disclosure | 2008-01-19 |
References
- http://browser.netscape.com/releasenotes/
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html
- http://secunia.com/advisories/28622/
- http://secunia.com/advisories/28754
- http://secunia.com/advisories/28766
- http://secunia.com/advisories/28808
- http://secunia.com/advisories/28815
- http://secunia.com/advisories/28818
- http://secunia.com/advisories/28839
- http://secunia.com/advisories/28864
- http://secunia.com/advisories/28865
- http://secunia.com/advisories/28877
- http://secunia.com/advisories/28879
- http://secunia.com/advisories/28924
- http://secunia.com/advisories/28939
- http://secunia.com/advisories/28958
- http://secunia.com/advisories/29049
- http://secunia.com/advisories/29086
- http://secunia.com/advisories/29098
- http://secunia.com/advisories/29164
→ the Explorer · watch your stack · NVD