CVE-2007-1947

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-04-11 · updated 2026-06-16

Description

Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.04 for Mozilla Firefox allows remote attackers to bypass zone restrictions, read arbitrary file:// URIs, or execute arbitrary code in the browser chrome by overwriting the toString function via a certain function declaration, related to incorrect identification of anonymous JavaScript functions, a different issue than CVE-2007-1878.

Affected products

Parakey Inc. Firebug: through 1.03

References

http://larholm.com/2007/04/06/more-0day-in-firebug/
http://larholm.com/2007/04/06/more-0day-in-firebug/#comment-6
http://www.securityfocus.com/archive/1/464875/100/0/threaded
http://larholm.com/2007/04/06/more-0day-in-firebug/
http://larholm.com/2007/04/06/more-0day-in-firebug/#comment-6
http://www.securityfocus.com/archive/1/464875/100/0/threaded

Get alerted when CVE-2007-1947 or the next vulnerability affects your stack