VULNERABILITY INTELLIGENCE
CVE-2009-1307
CVSS score6.8 MEDIUM
EPSS probability2.18%
CISA KEVNot currently listed
Published2009-04-22
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Description
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI.
Weakness classification
- CWE-20: Improper Input Validation