VULNERABILITY INTELLIGENCE
CVE-2008-0418
CVSS score4.3 MEDIUM
EPSS probability8.63%
CISA KEVNot currently listed
Published2008-02-08
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:N/A:N
Description
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.
Weakness classification
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')