PT-2006-6722 · Mozilla+3 · Firefox+3
Published
2006-11-24
·
Updated
2024-12-12
·
CVE-2006-6077
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions 2.0 and 1.5.0.8 and earlier
Netscape versions 8.1.2 and possibly other versions
Description
The issue concerns the password management functionality in the affected browsers. It does not properly verify that the ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a password. This allows remote attackers to obtain passwords via a password INPUT element on a different web page located on the web site intended for this password.
Recommendations
For Mozilla Firefox versions 2.0 and 1.5.0.8 and earlier, update to a version that properly verifies the ACTION URL in a FORM element containing a password INPUT element.
For Netscape versions 8.1.2 and possibly other versions, update to a version that properly verifies the ACTION URL in a FORM element containing a password INPUT element.
As a temporary workaround, consider disabling the password management functionality until a patch is available.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hp-Ux
Firefox
Netscape
Red Hat