CVE-2007-4357 - Vulnerability Details - OpenCVE

Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL. NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be modified.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00597.

Key SSVC decision points have not yet been added.

Vendors	Products
Mozilla Subscribe	Firefox Subscribe

Configuration 1 [-]

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2007-4340	Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL. NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be modified.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing
http://www.eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html
http://www.securityfocus.com/archive/1/475467/100/100/threaded
http://www.securityfocus.com/archive/1/475531/100/100/threaded
http://www.securityfocus.com/archive/1/475651/100/0/threaded
http://www.securityfocus.com/archive/1/475970/100/0/threaded
http://www.securityfocus.com/archive/1/476062/100/0/threaded

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-08-15T00:00:00

Updated: 2024-08-07T14:53:55.770Z

Reserved: 2007-08-14T00:00:00

Link: CVE-2007-4357

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-08-15T00:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-4357

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-Other

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-08-03T00:00:00", "descriptions": [{"lang": "en", "value": "Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL. NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be modified."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20070803 Re: [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/475531/100/100/threaded"}, {"name": "20070803 [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/475467/100/100/threaded"}, {"name": "20070804 Re:Re: [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/475651/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing"}, {"name": "20070809 Re:Re: [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/476062/100/0/threaded"}, {"name": "20070806 Re: [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/475970/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://www.eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-4357", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL. NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be modified."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20070803 Re: [ELEYTT] 3SIERPIEN2007", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/475531/100/100/threaded"}, {"name": "20070803 [ELEYTT] 3SIERPIEN2007", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/475467/100/100/threaded"}, {"name": "20070804 Re:Re: [ELEYTT] 3SIERPIEN2007", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/475651/100/0/threaded"}, {"name": "http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing", "refsource": "MISC", "url": "http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing"}, {"name": "20070809 Re:Re: [ELEYTT] 3SIERPIEN2007", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/476062/100/0/threaded"}, {"name": "20070806 Re: [ELEYTT] 3SIERPIEN2007", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/475970/100/0/threaded"}, {"name": "http://www.eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html", "refsource": "MISC", "url": "http://www.eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:53:55.770Z"}, "title": "CVE Program Container", "references": [{"name": "20070803 Re: [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/475531/100/100/threaded"}, {"name": "20070803 [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/475467/100/100/threaded"}, {"name": "20070804 Re:Re: [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/475651/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing"}, {"name": "20070809 Re:Re: [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/476062/100/0/threaded"}, {"name": "20070806 Re: [ELEYTT] 3SIERPIEN2007", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/475970/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4357", "datePublished": "2007-08-15T00:00:00", "dateReserved": "2007-08-14T00:00:00", "dateUpdated": "2024-08-07T14:53:55.770Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "67F139F7-1344-4EE5-B6A4-ED2653B8875A", "versionEndIncluding": "2.0.0.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL. NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be modified."}, {"lang": "es", "value": "Mozilla Firefox 2.0.0.6 y anteriores permite a atacantes remotos falsificar los contenidos de la barra de estado mediante un enlace a un URI data: conteniendo una URL codificada. NOTA: la severidad de este problema ha sido cuestionada por una tercera parte fiable, puesto que la funcionalidad pretendida de la barra de estado permite que sea modificada."}], "id": "CVE-2007-4357", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-08-15T00:17:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/475467/100/100/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/475531/100/100/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/475651/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/475970/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/476062/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/475467/100/100/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/475531/100/100/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/475651/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/475970/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/476062/100/0/threaded"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}