CVE-2008-0593

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-02-09 · updated 2026-06-16
Weakness: CWE-200

Description

Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original URL, such as with Single-Signon systems.

Affected products

Mozilla Firefox: through 2.0.0.11; 0.2, 0.9.2, 1.0.2, 1.5.0.2, 1.5.0.12, 1.5.2 (+3)
Mozilla Seamonkey: through 1.1.17; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+17)

References

http://browser.netscape.com/releasenotes/
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html
http://secunia.com/advisories/28754
http://secunia.com/advisories/28758
http://secunia.com/advisories/28766
http://secunia.com/advisories/28815
http://secunia.com/advisories/28818
http://secunia.com/advisories/28839
http://secunia.com/advisories/28864
http://secunia.com/advisories/28865
http://secunia.com/advisories/28877
http://secunia.com/advisories/28879

Get alerted when CVE-2008-0593 or the next vulnerability affects your stack