CVE-2007-5960

CVSS V2 Medium 4.3 CVSS V3 None

Description

Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.

Overview

CVE ID
CVE-2007-5960

Assigner
secalert@redhat.com

Vulnerability Status
Modified

Published Version
2007-11-26T23:46:00

Last Modified Date
2023-02-13T02:18:32

Weakness Enumerations

CWE	URL
CWE-22	http://cwe.mitre.org/data/definitions/22.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
cpe:2.3:a:mozilla:firefox:0.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.9:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.9.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.9.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.9.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.10:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.10.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.9:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.10:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.11:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.12:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0:beta1::::::	1	OR
cpe:2.3:a:mozilla:firefox:2.0:rc2::::::	1	OR
cpe:2.3:a:mozilla:firefox:2.0:rc3::::::	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.9:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey::::::::	1	OR	1.1.7

CVSS Version 2

Version
2.0

Vector String
AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector
NETWORK

Access Compatibility
MEDIUM

Authentication
NONE

Confidentiality Impact
NONE

Integrity Impact
PARTIAL

Availability Impact
NONE

Base Score
4.3

Severity
MEDIUM

Exploitability Score
8.6

Impact Score
2.9

References

Reference URL	Reference Tags
http://www.mozilla.org/security/announce/2007/mfsa2007-39.html
http://www.debian.org/security/2007/dsa-1424
http://www.debian.org/security/2007/dsa-1425
http://www.redhat.com/support/errata/RHSA-2007-1082.html	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-1084.html	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html
http://www.ubuntu.com/usn/usn-546-2
http://www.securityfocus.com/bid/26589
http://securitytracker.com/id?1018995
http://secunia.com/advisories/27725	Vendor Advisory
http://secunia.com/advisories/27793	Vendor Advisory
http://secunia.com/advisories/27796	Vendor Advisory
http://secunia.com/advisories/27797	Vendor Advisory
http://secunia.com/advisories/27816	Vendor Advisory
http://secunia.com/advisories/27944	Vendor Advisory
http://secunia.com/advisories/27957	Vendor Advisory
http://secunia.com/advisories/28001	Vendor Advisory
http://bugs.gentoo.org/show_bug.cgi?id=198965
http://bugs.gentoo.org/show_bug.cgi?id=200909
https://issues.rpath.com/browse/RPL-1984
http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260
http://security.gentoo.org/glsa/glsa-200712-21.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:246
http://www.redhat.com/support/errata/RHSA-2007-1083.html	Vendor Advisory
http://secunia.com/advisories/28016	Vendor Advisory
http://secunia.com/advisories/27955	Vendor Advisory
http://secunia.com/advisories/28171	Vendor Advisory
http://secunia.com/advisories/28277	Vendor Advisory
http://browser.netscape.com/releasenotes/
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006
http://secunia.com/advisories/27800	Vendor Advisory
http://secunia.com/advisories/27838	Vendor Advisory
http://secunia.com/advisories/27845	Vendor Advisory
http://secunia.com/advisories/28398	Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html
http://secunia.com/advisories/27855	Vendor Advisory
http://secunia.com/advisories/27979	Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1
http://wiki.rpath.com/Advisories:rPSA-2008-0093
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
https://issues.rpath.com/browse/RPL-1995
http://secunia.com/advisories/29164
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1
http://www.vupen.com/english/advisories/2007/4002
http://www.vupen.com/english/advisories/2008/0083
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://www.vupen.com/english/advisories/2007/4018
http://www.vupen.com/english/advisories/2008/0643
https://exchange.xforce.ibmcloud.com/vulnerabilities/38644
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9794
https://usn.ubuntu.com/546-1/
http://www.securityfocus.com/archive/1/488971/100/0/threaded
http://www.securityfocus.com/archive/1/488002/100/0/threaded

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2007-5960
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5960

History

Created	Old Value	New Value	Data Type	Notes
2022-05-10 18:19:45				Added to TrackCVE
2023-02-02 21:01:50		2023-02-02T19:15:29	CVE Modified Date	updated
2023-02-02 21:01:51	Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.	CVE-2007-5960 Mozilla Cross-site Request Forgery flaw	Description	updated
2023-02-13 03:02:17		2023-02-13T02:18:32	CVE Modified Date	updated
2023-02-13 03:02:19	CVE-2007-5960 Mozilla Cross-site Request Forgery flaw	Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.	Description	updated