Vulnerability 25983 - CERT Civis.Net

Vulnerability Name:

CCN-25983

Published:

2006-04-21

Updated:

2006-04-21

Summary:

Multiple Mozilla products, including Thunderbird, Mozilla Suite and SeaMonkey, could allow a remote attacker to execute malicious JavaScript on a victim's system. A remote attacker could exploit this vulnerability if a victim uses the default HTML "rich mail" editor when forwarding in-line mail to execute JavaScript in the victim's mail client with privileges of the victim, allowing the attacker to perform malicious actions on the victim's system or use their email client to send spam.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial