CVE-2007-3511

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-07-03 · updated 2026-06-16

Description

The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated by changing focus from a textarea to a file upload field.

Affected products

Mozilla Firefox: through 2.0.0.7; 1.5.0.12, 2.0.0.4, 2.0.0.5, 2.0.0.6
Mozilla Seamonkey: through 1.1.4; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+11)

References

http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0646.html
http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0658.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://osvdb.org/37994
http://secunia.com/advisories/25904
http://secunia.com/advisories/27276
http://secunia.com/advisories/27298
http://secunia.com/advisories/27325
http://secunia.com/advisories/27327
http://secunia.com/advisories/27335
http://secunia.com/advisories/27336
http://secunia.com/advisories/27356

Get alerted when CVE-2007-3511 or the next vulnerability affects your stack