6.8

CVE-2009-2065

Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."

Data is provided by the National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version <= 3.0.9
Mozilla ≫ Firefox Version0.1
Mozilla ≫ Firefox Version0.2
Mozilla ≫ Firefox Version0.3
Mozilla ≫ Firefox Version0.4
Mozilla ≫ Firefox Version0.5
Mozilla ≫ Firefox Version0.6
Mozilla ≫ Firefox Version0.6.1
Mozilla ≫ Firefox Version0.7
Mozilla ≫ Firefox Version0.7.1
Mozilla ≫ Firefox Version0.8
Mozilla ≫ Firefox Version0.9
Mozilla ≫ Firefox Version0.9 Updaterc
Mozilla ≫ Firefox Version0.9.1
Mozilla ≫ Firefox Version0.9.2
Mozilla ≫ Firefox Version0.9.3
Mozilla ≫ Firefox Version0.9_rc
Mozilla ≫ Firefox Version0.10
Mozilla ≫ Firefox Version0.10.1
Mozilla ≫ Firefox Version1.0
Mozilla ≫ Firefox Version1.0 Updatepreview_release
Mozilla ≫ Firefox Version1.0.1
Mozilla ≫ Firefox Version1.0.2
Mozilla ≫ Firefox Version1.0.3
Mozilla ≫ Firefox Version1.0.4
Mozilla ≫ Firefox Version1.0.5
Mozilla ≫ Firefox Version1.0.6
Mozilla ≫ Firefox Version1.0.7
Mozilla ≫ Firefox Version1.0.8
Mozilla ≫ Firefox Version1.4.1
Mozilla ≫ Firefox Version1.5
Mozilla ≫ Firefox Version1.5 Updatebeta1
Mozilla ≫ Firefox Version1.5 Updatebeta2
Mozilla ≫ Firefox Version1.5.0.1
Mozilla ≫ Firefox Version1.5.0.2
Mozilla ≫ Firefox Version1.5.0.3
Mozilla ≫ Firefox Version1.5.0.4
Mozilla ≫ Firefox Version1.5.0.5
Mozilla ≫ Firefox Version1.5.0.6
Mozilla ≫ Firefox Version1.5.0.7
Mozilla ≫ Firefox Version1.5.0.8
Mozilla ≫ Firefox Version1.5.0.9
Mozilla ≫ Firefox Version1.5.0.10
Mozilla ≫ Firefox Version1.5.0.11
Mozilla ≫ Firefox Version1.5.0.12
Mozilla ≫ Firefox Version1.5.1
Mozilla ≫ Firefox Version1.5.2
Mozilla ≫ Firefox Version1.5.3
Mozilla ≫ Firefox Version1.5.4
Mozilla ≫ Firefox Version1.5.6
Mozilla ≫ Firefox Version1.5.7
Mozilla ≫ Firefox Version1.5.8
Mozilla ≫ Firefox Version1.8
Mozilla ≫ Firefox Version2.0
Mozilla ≫ Firefox Version2.0 Updatebeta_1
Mozilla ≫ Firefox Version2.0 Updatebeta1
Mozilla ≫ Firefox Version2.0 Updaterc3
Mozilla ≫ Firefox Version2.0.0.3
Mozilla ≫ Firefox Version2.0.0.5
Mozilla ≫ Firefox Version2.0.0.7
Mozilla ≫ Firefox Version2.0.0.8
Mozilla ≫ Firefox Version2.0.0.9
Mozilla ≫ Firefox Version2.0.0.10
Mozilla ≫ Firefox Version2.0.0.11
Mozilla ≫ Firefox Version2.0.0.13
Mozilla ≫ Firefox Version2.0.0.14
Mozilla ≫ Firefox Version2.0.0.16
Mozilla ≫ Firefox Version2.0.0.17
Mozilla ≫ Firefox Version2.0.0.18
Mozilla ≫ Firefox Version2.0.0.19
Mozilla ≫ Firefox Version2.0.0.20
Mozilla ≫ Firefox Version2.0.0.21
Mozilla ≫ Firefox Version2.0_.1
Mozilla ≫ Firefox Version2.0_.4
Mozilla ≫ Firefox Version2.0_.6
Mozilla ≫ Firefox Version2.0_.9
Mozilla ≫ Firefox Version2.0_.10
Mozilla ≫ Firefox Version2.0_8
Mozilla ≫ Firefox Version3.0
Mozilla ≫ Firefox Version3.0.2
Mozilla ≫ Firefox Version3.0.3
Mozilla ≫ Firefox Version3.0.4
Mozilla ≫ Firefox Version3.0.5
Mozilla ≫ Firefox Version3.0.6
Mozilla ≫ Firefox Version3.0.7
Mozilla ≫ Firefox Version3.0.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.3% 0.502
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.