Mozilla Firefox Input Type HTML Tag Unauthorized Access (deprecated)

Medium Nessus Network Monitor Plugin ID 2116

Synopsis

The remote host may be tricked into running an executable file.

Description

The remote host is using a vulnerable version of Mozilla, an open-source web browser. It is reported that Mozilla versions prior 1.7.1 present an issue in the INPUT tag. An attacker may craft a malicious web page that may secretly upload files readable by the victim on a remote computer.

Solution

Upgrade or patch according to vendor recommendations.

Plugin Details

Severity: Medium

ID: 2116

Family: Web Clients

Published: 2004/08/18

Updated: 2019/03/06

Dependencies: 1735, 8314

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSS v3.0

Base Score: 7.5

Temporal Score: 7.1

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Reference Information

CVE: CVE-2004-0765, CVE-2004-0597, CVE-2004-0599, CVE-2004-0718, CVE-2004-0722, CVE-2004-0757, CVE-2004-0758, CVE-2004-0760, CVE-2004-0761, CVE-2004-0762, CVE-2004-0763, CVE-2004-0764, CVE-2005-0399, CVE-2005-0989, CVE-2005-1153, CVE-2005-1154, CVE-2005-1155, CVE-2005-1156, CVE-2005-1157, CVE-2005-1159, CVE-2005-1160, CVE-2005-1476, CVE-2005-1477, CVE-2005-1531, CVE-2005-1532, CVE-2005-2701, CVE-2005-2702, CVE-2005-2703, CVE-2005-2704, CVE-2005-2705, CVE-2005-2706, CVE-2005-2707, CVE-2005-2968, CVE-2004-0759

BID: 15495, 10874