CVE-2014-1561

Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.

CVSS v2.0 5.8 MEDIUM

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:P

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/59760
http://secunia.com/advisories/60628
http://www.mozilla.org/security/announce/2014/mfsa2014-60.html	Vendor Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
http://www.securitytracker.com/id/1030619
https://bugzilla.mozilla.org/show_bug.cgi?id=1000514	Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=910375	Issue Tracking
https://security.gentoo.org/glsa/201504-01

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2014-07-23 11:12

Updated : 2017-01-07 02:59

NVD link : CVE-2014-1561

Mitre link : CVE-2014-1561

CVE.ORG link : CVE-2014-1561

JSON object : View

Products Affected

mozilla

firefox

oracle

solaris

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2014-1561", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-07-23T11:12:43.403", "references": [{"url": "http://secunia.com/advisories/59760", "source": "security@mozilla.org"}, {"url": "http://secunia.com/advisories/60628", "source": "security@mozilla.org"}, {"url": "http://www.mozilla.org/security/announce/2014/mfsa2014-60.html", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.securitytracker.com/id/1030619", "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1000514", "tags": ["Issue Tracking"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=910375", "tags": ["Issue Tracking"], "source": "security@mozilla.org"}, {"url": "https://security.gentoo.org/glsa/201504-01", "source": "security@mozilla.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization."}, {"lang": "es", "value": "Mozilla Firefox anterior a 31.0 no restringe debidamente el uso de eventos de arrastrar y soltar para falsificar eventos de personalizaci\u00f3n, lo que permite a atacantes remotos alterar la colocaci\u00f3n de iconos de la interfaz del usuario a trav\u00e9s de c\u00f3digo JavaScript manipulado que se encuentra durante la personalizaci\u00f3n de (1) p\u00e1ginas, (2) paneles o (3) barras de herramientas."}], "lastModified": "2017-01-07T02:59:40.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BD70C79-7EA7-49CB-B3D6-6C77E0C55BB4", "versionEndIncluding": "30.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79A602C5-61FE-47BA-9786-F045B6C6DBA8"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}