CVE-2007-2870: XSS

Published Jun 1, 2007

Updated

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to bypass the same-origin policy and conduct cross-site scripting (XSS) and other attacks by using the addEventListener method to add an event listener for a site, which is executed in the context of that site.

Affected Software

18 affected components

Mozilla Firefox=1.5.0.6

Mozilla SeaMonkey=1.0.9

Mozilla Firefox=2.0.0.2

Mozilla Firefox=1.5.0.10

Mozilla Firefox=1.5.0.3

Mozilla Firefox=1.5.0.11

Mozilla Firefox=1.5

Mozilla SeaMonkey=1.1.2

Mozilla Firefox=1.5.0.7

Mozilla Firefox=2.0

Mozilla Firefox=1.5.0.8

Mozilla Firefox=2.0.0.3

Mozilla Firefox=1.5.0.9

Mozilla Firefox=1.5.0.5

Mozilla Firefox=1.5.0.2

Mozilla Firefox=2.0.0.1

Mozilla Firefox=1.5.0.4

Mozilla Firefox=1.5.0.1

Event History

Jun 1, 2007

CVE Published

12:30 AM

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2870?

CVE-2007-2870 is considered a high severity vulnerability due to its ability to bypass the same-origin policy.

How do I fix CVE-2007-2870?

To mitigate CVE-2007-2870, users should upgrade to Firefox version 1.5.0.12 or 2.0.0.4, or the equivalent version of SeaMonkey.

What versions are affected by CVE-2007-2870?

CVE-2007-2870 affects Mozilla Firefox versions 1.5.x prior to 1.5.0.12 and 2.x prior to 2.0.0.4, as well as SeaMonkey versions 1.0.9 and 1.1.2.

What type of attacks can be conducted using CVE-2007-2870?

CVE-2007-2870 allows remote attackers to conduct cross-site scripting (XSS) and other related attacks.

What is the cause of CVE-2007-2870?

CVE-2007-2870 is caused by the misuse of the addEventListener method that enables scripts from different origins to interact.