VULNERABILITY INTELLIGENCE
CVE-2011-3670
CVSS score5 MEDIUM
EPSS probability2.14%
CISA KEVNot currently listed
Published2012-02-01
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:N/A:N
Description
Mozilla Firefox before 3.6.26 and 4.x through 6.0, Thunderbird before 3.1.18 and 5.0 through 6.0, and SeaMonkey before 2.4 do not properly enforce the IPv6 literal address syntax, which allows remote attackers to obtain sensitive information by making XMLHttpRequest calls through a proxy and reading the error messages.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor