peter bassill · operator
$ cve CVE-2008-4582 JSON

CVE-2008-4582 EXPLOIT

4.3
MEDIUM · CVSS 2.0 · EPSS 10.2% (pctl 96)

Patch early

A public exploit exists.

Description

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

Scoring

CVSS4.3 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS10.19% — more likely to be exploited than 96% of all CVEs
WeaknessCWE-264
On CISA KEVno
Public exploityes
Published2008-10-15
Last modified2026-06-16

Affected (5)

VendorProduct
canonicalubuntu linux
debiandebian linux
microsoftwindows
mozillafirefox
mozillaseamonkey

Public exploits

SourceTitleDate
exploit-dbMozilla Firefox 3.0.3 - Internet Shortcut Same Origin Policy Violation2008-10-07

References

→ the Explorer  ·  watch your stack  ·  NVD