CVE-2002-2437

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-12-07 · updated 2026-06-16
Weakness: CWE-264

Description

The JavaScript implementation in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.

Affected products

Mozilla Firefox: through 3.6.24; 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+51)
Mozilla Seamonkey: through 2.1; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+56)
Mozilla Thunderbird: through 3.1.16; 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+22)

References

http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/
http://bugzilla.mozilla.org/show_bug.cgi?id=147777
http://w2spconf.com/2010/papers/p26.pdf
https://developer.mozilla.org/en/CSS/Privacy_and_the_:visited_selector
http://blog.mozilla.com/security/2010/03/31/plugging-the-css-history-leak/
http://bugzilla.mozilla.org/show_bug.cgi?id=147777
http://w2spconf.com/2010/papers/p26.pdf
https://developer.mozilla.org/en/CSS/Privacy_and_the_:visited_selector

Get alerted when CVE-2002-2437 or the next vulnerability affects your stack