CWE Code: 94
Vulnerability Type: privilege_escalation
CVSS Score: 5.1
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: mozilla firefox before 3.0.19 and 3.5.x before 3.5.8, and seamonkey before 2.0.3, when the xmlhttprequestspy module in the firebug add-on is used, does not properly handle interaction between the xmlhttprequestspy object and chrome privileged objects, which allows remote attackers to execute arbitrary javascript via a crafted http response.
Access Authentication: NONE
Access Complexity: HIGH
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2010-04-05
Last Modified Date: 2018-10-30