{"api_version":"1","generated_at":"2026-07-23T03:47:57+00:00","cve":"CVE-2007-6589","urls":{"html":"https://cve.report/CVE-2007-6589","api":"https://cve.report/api/cve/CVE-2007-6589.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-6589","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-6589"},"summary":{"title":"CVE-2007-6589","description":"The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-12-28 21:46:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=369814","name":"https://bugzilla.mozilla.org/show_bug.cgi?id=369814","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"369814 – jar: protocol is an XSS hazard due to ignoring mime type and being considered same-origin with hosting site","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://blog.beford.org/?p=8","name":"http://blog.beford.org/?p=8","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"beford.org » Firefox jar: Protocol Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/0083","name":"http://www.vupen.com/english/advisories/2008/0083","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742","name":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"HPSBUX02153 SSRT061181 rev.7 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) - c00771742 - \n\t\tHP Business Support Center","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6033","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6033","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/43477","name":"http://osvdb.org/43477","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=403331","name":"https://bugzilla.mozilla.org/show_bug.cgi?id=403331","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug 403331 – Sort out jar: behavior on HTTP redirects","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mozilla.org/security/announce/2007/mfsa2007-37.html","name":"http://www.mozilla.org/security/announce/2007/mfsa2007-37.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"MFSA 2007-37: jar: URI scheme XSS hazard","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-6589","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-6589","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"6589","vulnerable":"1","versionEndIncluding":"2.0.0.9","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"6589","vulnerable":"1","versionEndIncluding":"1.1.6","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"seamonkey","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T16:11:06.026Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=403331"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.mozilla.org/security/announce/2007/mfsa2007-37.html"},{"name":"HPSBUX02153","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://blog.beford.org/?p=8"},{"name":"ADV-2008-0083","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/0083"},{"name":"43477","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/43477"},{"name":"oval:org.mitre.oval:def:6033","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6033"},{"name":"SSRT061181","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=369814"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-11-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=403331"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.mozilla.org/security/announce/2007/mfsa2007-37.html"},{"name":"HPSBUX02153","tags":["vendor-advisory","x_refsource_HP"],"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"},{"tags":["x_refsource_MISC"],"url":"http://blog.beford.org/?p=8"},{"name":"ADV-2008-0083","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/0083"},{"name":"43477","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/43477"},{"name":"oval:org.mitre.oval:def:6033","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6033"},{"name":"SSRT061181","tags":["vendor-advisory","x_refsource_HP"],"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=369814"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-6589","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://bugzilla.mozilla.org/show_bug.cgi?id=403331","refsource":"CONFIRM","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=403331"},{"name":"http://www.mozilla.org/security/announce/2007/mfsa2007-37.html","refsource":"CONFIRM","url":"http://www.mozilla.org/security/announce/2007/mfsa2007-37.html"},{"name":"HPSBUX02153","refsource":"HP","url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"},{"name":"http://blog.beford.org/?p=8","refsource":"MISC","url":"http://blog.beford.org/?p=8"},{"name":"ADV-2008-0083","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/0083"},{"name":"43477","refsource":"OSVDB","url":"http://osvdb.org/43477"},{"name":"oval:org.mitre.oval:def:6033","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6033"},{"name":"SSRT061181","refsource":"HP","url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"},{"name":"https://bugzilla.mozilla.org/show_bug.cgi?id=369814","refsource":"CONFIRM","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=369814"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-6589","datePublished":"2007-12-28T21:00:00.000Z","dateReserved":"2007-12-28T00:00:00.000Z","dateUpdated":"2024-08-07T16:11:06.026Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-12-28 21:46:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndIncluding":"2.0.0.9","matchCriteriaId":"F02B3261-6167-4C75-A6E0-EE6EC80AEF03"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*","versionEndIncluding":"1.1.6","matchCriteriaId":"3F1A12AA-448B-4DF3-AC60-794433E2628B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"6589","Ordinal":"1","Title":"CVE-2007-6589","CVE":"CVE-2007-6589","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"6589","Ordinal":"1","NoteData":"The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.","Type":"Description","Title":"CVE-2007-6589"},{"CveYear":"2007","CveId":"6589","Ordinal":"2","NoteData":"2007-12-28","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"6589","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}