CVE-2009-1312

Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct…

published April 22, 2009

CVSS
—
EPSS
6%
Percentile
92.8
In the wild
Unconfirmed
What it is

Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05565 · 92.8th percentile
Published
2009-04-22T18:00Z
EPSS history
Timeline
  • 22 APR 18:00Z
    Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct…
    cvelistv5