{"api_version":"1","generated_at":"2026-07-23T10:25:07+00:00","cve":"CVE-2009-3988","urls":{"html":"https://cve.report/CVE-2009-3988","api":"https://cve.report/api/cve/CVE-2009-3988.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-3988","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-3988"},"summary":{"title":"CVE-2009-3988","description":"Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.","state":"PUBLISHED","assigner":"mitre","published_at":"2010-02-22 13:00:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2010/0405","name":"http://www.vupen.com/english/advisories/2010/0405","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 12 Update: galeon-2.0.7-20.fc12","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-895-1","name":"http://www.ubuntu.com/usn/USN-895-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-895-1: Firefox 3.0 and Xulrunner 1.9 vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:042","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:042","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Support / Security / Advisories /  / MDVSA-2010:042 | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=504862","name":"https://bugzilla.mozilla.org/show_bug.cgi?id=504862","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"504862 – (CVE-2009-3988) XSS due to window.dialogArguments accessible cross-domain (MSVR-09-0047 / ZDI-CAN-535)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2010/dsa-1999","name":"http://www.debian.org/security/2010/dsa-1999","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian -- Security Information -- DSA-1999-1 xulrunner","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 12 Update: seamonkey-2.0.3-1.fc12","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-896-1","name":"http://www.ubuntu.com/usn/USN-896-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-896-1: Firefox 3.5 and Xulrunner 1.9.1 vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/37242","name":"http://secunia.com/advisories/37242","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Mozilla Firefox Multiple Vulnerabilities - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/38847","name":"http://secunia.com/advisories/38847","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SUSE update for MozillaFirefox and seamonkey - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0112.html","name":"http://www.redhat.com/support/errata/RHSA-2010-0112.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"rhn.redhat.com | Red Hat Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html","name":"http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[security-announce] SUSE Security Announcement: Mozilla Firefox (SUSE-SA","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 11 Update: epiphany-extensions-2.26.1-10.fc11","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56362","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56362","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mozilla.org/security/announce/2010/mfsa2010-04.html","name":"http://www.mozilla.org/security/announce/2010/mfsa2010-04.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"MFSA 2010-04: XSS due to window.dialogArguments being readable cross-domain","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3988","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3988","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.15","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.0.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.5.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.5.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.5.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.5.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.5.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"3.5.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"3.0.17","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"seamonkey","cpe6":"2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"seamonkey","cpe6":"2.0","cpe7":"alpha_1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"seamonkey","cpe6":"2.0","cpe7":"alpha_2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"seamonkey","cpe6":"2.0","cpe7":"alpha_3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"seamonkey","cpe6":"2.0","cpe7":"beta_1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"seamonkey","cpe6":"2.0","cpe7":"beta_2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"seamonkey","cpe6":"2.0","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2009","cve_id":"3988","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"seamonkey","cpe6":"2.0","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T06:45:51.012Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"USN-895-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-895-1"},{"name":"38847","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/38847"},{"name":"SUSE-SA:2010:015","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html"},{"name":"MDVSA-2010:042","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:042"},{"name":"FEDORA-2010-1936","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html"},{"name":"RHSA-2010:0112","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2010-0112.html"},{"name":"FEDORA-2010-1932","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html"},{"name":"oval:org.mitre.oval:def:8355","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355"},{"name":"DSA-1999","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2010/dsa-1999"},{"name":"FEDORA-2010-1727","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html"},{"name":"mozilla-showmodaldialog-xss(56362)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56362"},{"name":"USN-896-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-896-1"},{"name":"ADV-2010-0405","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2010/0405"},{"name":"37242","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/37242"},{"name":"oval:org.mitre.oval:def:9384","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.mozilla.org/security/announce/2010/mfsa2010-04.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=504862"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2010-02-17T00:00:00.000Z","descriptions":[{"lang":"en","value":"Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-18T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"USN-895-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-895-1"},{"name":"38847","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/38847"},{"name":"SUSE-SA:2010:015","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html"},{"name":"MDVSA-2010:042","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:042"},{"name":"FEDORA-2010-1936","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html"},{"name":"RHSA-2010:0112","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2010-0112.html"},{"name":"FEDORA-2010-1932","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html"},{"name":"oval:org.mitre.oval:def:8355","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355"},{"name":"DSA-1999","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2010/dsa-1999"},{"name":"FEDORA-2010-1727","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html"},{"name":"mozilla-showmodaldialog-xss(56362)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56362"},{"name":"USN-896-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-896-1"},{"name":"ADV-2010-0405","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2010/0405"},{"name":"37242","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/37242"},{"name":"oval:org.mitre.oval:def:9384","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.mozilla.org/security/announce/2010/mfsa2010-04.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=504862"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-3988","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"USN-895-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-895-1"},{"name":"38847","refsource":"SECUNIA","url":"http://secunia.com/advisories/38847"},{"name":"SUSE-SA:2010:015","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html"},{"name":"MDVSA-2010:042","refsource":"MANDRIVA","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:042"},{"name":"FEDORA-2010-1936","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html"},{"name":"RHSA-2010:0112","refsource":"REDHAT","url":"http://www.redhat.com/support/errata/RHSA-2010-0112.html"},{"name":"FEDORA-2010-1932","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html"},{"name":"oval:org.mitre.oval:def:8355","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355"},{"name":"DSA-1999","refsource":"DEBIAN","url":"http://www.debian.org/security/2010/dsa-1999"},{"name":"FEDORA-2010-1727","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html"},{"name":"mozilla-showmodaldialog-xss(56362)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56362"},{"name":"USN-896-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-896-1"},{"name":"ADV-2010-0405","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2010/0405"},{"name":"37242","refsource":"SECUNIA","url":"http://secunia.com/advisories/37242"},{"name":"oval:org.mitre.oval:def:9384","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384"},{"name":"http://www.mozilla.org/security/announce/2010/mfsa2010-04.html","refsource":"CONFIRM","url":"http://www.mozilla.org/security/announce/2010/mfsa2010-04.html"},{"name":"https://bugzilla.mozilla.org/show_bug.cgi?id=504862","refsource":"CONFIRM","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=504862"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-3988","datePublished":"2010-02-21T17:00:00.000Z","dateReserved":"2009-11-19T00:00:00.000Z","dateUpdated":"2024-08-07T06:45:51.012Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2010-02-22 13:00:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndIncluding":"3.0.17","matchCriteriaId":"82D0970A-C2EB-4D54-9C30-AEA334A47F6E"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*","matchCriteriaId":"412DF091-7604-4110-87A0-3488116A97E5"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*","matchCriteriaId":"11E07FED-ABDB-4B0A-AB2E-4CBF1EAC4301"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*","matchCriteriaId":"9A6558F1-9E0D-4107-909A-8EF4BC8A9C2F"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*","matchCriteriaId":"63DF3D65-C992-44CF-89B4-893526C6242E"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*","matchCriteriaId":"A9024117-2E8B-4240-9E21-CC501F3879B5"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*","matchCriteriaId":"FBC3CAD3-2F54-4E32-A0C9-0D826C45AC23"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*","matchCriteriaId":"52624B41-AB34-40AD-8709-D9646B618AB0"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*","matchCriteriaId":"917E9856-9556-4FD6-A834-858F8837A6B4"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*","matchCriteriaId":"98BBD74D-930C-4D80-A91B-0D61347BAA63"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*","matchCriteriaId":"FAF2E696-883D-4DE5-8B79-D8E5D9470253"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*","matchCriteriaId":"94E04FD9-38E8-462D-82C2-729F7F7F0465"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*","matchCriteriaId":"5888517E-3C57-4A0A-9895-EA4BCB0A0ED5"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*","matchCriteriaId":"0BB21291-B9F3-445E-A9E9-EA1822083DD3"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*","matchCriteriaId":"D595F649-ECBE-45E0-8AAD-BCBC65A654B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.14:*:*:*:*:*:*:*","matchCriteriaId":"4FE6E920-9A4C-431B-89EA-683A22F15ACD"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.0.15:*:*:*:*:*:*:*","matchCriteriaId":"18B6CC9F-6295-4598-B28B-0CA19D1D9F45"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*","matchCriteriaId":"76CD3BDF-A079-4EF3-ABDE-43CBDD08DB1F"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*","matchCriteriaId":"031E8624-5161-43AF-AF19-6BAB5A94FDD8"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*","matchCriteriaId":"54186D4A-C6F0-44AD-94FB-73B4346ABB6B"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*","matchCriteriaId":"47E50AD9-BA35-4817-BD4D-5D678FC5A3C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:*","matchCriteriaId":"DD09DE40-8C9B-41EA-B372-9E4E4830E8F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:*","matchCriteriaId":"F223FB83-0EDB-4429-94B9-1AEEF314B73F"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.5.6:*:*:*:*:*:*:*","matchCriteriaId":"BC6B977F-292F-4981-95A0-6065A3C487D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:3.5.7:*:*:*:*:*:*:*","matchCriteriaId":"342226B9-2C0C-416C-81FE-19C49F03AA88"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*","matchCriteriaId":"58EB8E8A-84DE-43AA-B8F0-B585FB73D724"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*","matchCriteriaId":"C19C0BF7-390D-4E2E-BA32-28DFF73C55F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*","matchCriteriaId":"5FE5E50C-80ED-4CA7-BC85-8BD2E324D527"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*","matchCriteriaId":"FEBF912C-A12E-4DBD-84AC-8B440E190BCE"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*","matchCriteriaId":"9B8EDED6-29EF-4A9F-955D-F5E6611C2141"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*","matchCriteriaId":"EDC9C82D-586A-48F4-B540-1E2AE79806B3"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*","matchCriteriaId":"51FCF83B-630A-4413-BFAA-0C24A6B8F4F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*","matchCriteriaId":"84B2AA0A-0220-49DD-82CD-37FDC563F146"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"3988","Ordinal":"1","Title":"CVE-2009-3988","CVE":"CVE-2009-3988","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"3988","Ordinal":"1","NoteData":"Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.","Type":"Description","Title":"CVE-2009-3988"},{"CveYear":"2009","CveId":"3988","Ordinal":"2","NoteData":"2010-02-21","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"3988","Ordinal":"3","NoteData":"2017-09-18","Type":"Other","Title":"Modified"}]}}}