vulnwire
7.5high

CVE-2016-9902

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 70%
Public exploits
0
none known

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

Exploit prediction (EPSS)

1.29% probability of exploitation in the next 30 days, higher than 70% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Mozilla Firefox ESR
  • Mozilla Firefox

Classification

Weakness

References

  • mozilla.org /security/advisories/mfsa2016-94/ · x_refsource_CONFIRM, x_transferred
  • mozilla.org /security/advisories/mfsa2016-95/ · x_refsource_CONFIRM, x_transferred
  • bugzilla.mozilla.org /show_bug.cgi?id=1320039 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/94885 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1037461 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • security.gentoo.org /glsa/201701-15 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2973.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2946.html · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.