CVE-2010-0172

toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does…

published March 25, 2010

CVSS
—
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to spoof an authorization dialog and capture credentials by demanding HTTP authentication in opportunistic circumstances.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01407 · 72.4th percentile
Published
2010-03-25T20:31Z
EPSS history
Timeline
  • 25 MAR 20:31Z
    toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does…
    cvelistv5