CVE-2007-6589

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-12-28 · updated 2026-06-16
Weakness: CWE-79

Description

The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.

Affected products

Mozilla Firefox: through 2.0.0.9
Mozilla Seamonkey: through 1.1.6

References

http://blog.beford.org/?p=8
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://osvdb.org/43477
http://www.mozilla.org/security/announce/2007/mfsa2007-37.html
http://www.vupen.com/english/advisories/2008/0083
https://bugzilla.mozilla.org/show_bug.cgi?id=369814
https://bugzilla.mozilla.org/show_bug.cgi?id=403331
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6033
http://blog.beford.org/?p=8
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://osvdb.org/43477
http://www.mozilla.org/security/announce/2007/mfsa2007-37.html

Get alerted when CVE-2007-6589 or the next vulnerability affects your stack