CVE-2010-0648

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-02-18 · updated 2026-06-16
Weakness: CWE-200

Description

Mozilla Firefox, possibly before 3.6, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value, related to an IFRAME element.

Affected products

Mozilla Firefox: through 3.5.7; 1.0, 1.0-preview_release, 1.0.1, 1.0.2, 1.0.3, 1.0.4 (+71)

References

http://code.google.com/p/chromium/issues/detail?id=32309
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041432.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041436.html
http://nomoreroot.blogspot.com/2010/01/little-bug-in-safari-and-google-chrome.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12665
http://code.google.com/p/chromium/issues/detail?id=32309
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041432.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041436.html
http://nomoreroot.blogspot.com/2010/01/little-bug-in-safari-and-google-chrome.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12665

Get alerted when CVE-2010-0648 or the next vulnerability affects your stack