CVE-2009-2061

high

Description

Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/51203

http://www.securityfocus.com/bid/35412

http://research.microsoft.com/apps/pubs/default.aspx?id=79323

Details

Source: Mitre, NVD

Published: 2009-06-15

Updated: 2017-08-17

Risk Information

CVSS v2

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Severity: High