Vulnerability Details : CVE-2008-0367
Mozilla Firefox 2.0.0.11, 3.0b2, and possibly earlier versions, when prompting for HTTP Basic Authentication, displays the site requesting the authentication after the Realm text, which might make it easier for remote HTTP servers to conduct phishing and spoofing attacks.
Vulnerability category: Information leak
Products affected by CVE-2008-0367
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-0367
0.47%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-0367
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2008-0367
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-0367
-
http://www.securityfocus.com/archive/1/485738/100/200/threaded
Third Party Advisory;VDB Entry
-
https://bugzilla.mozilla.org/show_bug.cgi?id=244273
Issue Tracking;Vendor Advisory
-
http://blog.mozilla.com/security/2008/01/04/basicauth-dialog-realm-value-spoofing/
Vendor Advisory
-
http://aviv.raffon.net/2008/01/05/FirefoxDialogSpoofingFAQ.aspx
Third Party Advisory
-
http://www.securityfocus.com/bid/27111
Third Party Advisory;VDB Entry
-
http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspx
Third Party Advisory
-
http://www.securityfocus.com/archive/1/485732/100/200/threaded
Third Party Advisory;VDB Entry
Jump to