peter bassill · operator
$ cve CVE-2014-1510 JSON

CVE-2014-1510 EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 82.3% (pctl 100)

Patch early

A public exploit exists.

Description

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS82.34% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-269
On CISA KEVno
Public exploityes
Published2014-03-19
Last modified2026-06-17

Affected (16)

VendorProduct
canonicalubuntu linux
debiandebian linux
mozillafirefox
mozillaseamonkey
mozillathunderbird
opensuseopensuse
redhatenterprise linux desktop
redhatenterprise linux eus
redhatenterprise linux server
redhatenterprise linux server aus
redhatenterprise linux server eus
redhatenterprise linux server tus
redhatenterprise linux workstation
susesuse linux enterprise desktop
susesuse linux enterprise server
susesuse linux enterprise software development kit

Public exploits

SourceTitleDate
exploit-dbMozilla Firefox - WebIDL Privileged JavaScript Injection (Metasploit)2014-08-28

References

→ the Explorer  ·  watch your stack  ·  NVD