CVE-2002-0354: Medium severity mozilla mozilla vulnerability
The XMLHttpRequest object (XMLHTTP) in Netscape 6.1 and Mozilla 0.9.7 allows remote attackers to read arbitrary files and list directories on a client system by opening a URL that redirects the browser to the file on the client, then reading the result using the responseText property.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability associated with CVE-2002-0354?
CVE-2002-0354 allows remote attackers to read arbitrary files and list directories on a client system by exploiting the XMLHttpRequest object in specific versions of Netscape and Mozilla browsers.
What versions of software are affected by CVE-2002-0354?
CVE-2002-0354 affects Mozilla versions 0.9.7, 1.0-rc1, 1.0-rc2, 1.0-rc3 and Netscape Navigator versions 6.1 and 6.2.
How can I mitigate the risks associated with CVE-2002-0354?
To mitigate CVE-2002-0354, users should upgrade to a newer, secure version of their web browsers that does not contain this vulnerability.
What impact does CVE-2002-0354 have on client systems?
The impact of CVE-2002-0354 is that it can potentially expose sensitive files and directory structures from a user's client system to remote attackers.
What is the exploit mechanism for CVE-2002-0354?
CVE-2002-0354 exploits the XMLHttpRequest object to open a URL that redirects to files on the client system, allowing retrieval of the content via the responseText property.