CVE-2009-4101 infoRSS 1.1.4.2 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting att...
HighCVSS 9.3
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
infoRSS 1.1.4.2 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| didier ernotte inforss | <= 1.1.4.2 | No fix listed |
| didier ernotte inforss | = 0.5 | No fix listed |
| didier ernotte inforss | = 0.7.7 | No fix listed |
| didier ernotte inforss | = 0.8.4 | No fix listed |
| didier ernotte inforss | = 0.8.7 | No fix listed |
| didier ernotte inforss | = 0.8.8.1 | No fix listed |
| didier ernotte inforss | = 0.8.8.2 | No fix listed |
| didier ernotte inforss | = 0.8.9 | No fix listed |
| didier ernotte inforss | = 0.8.9.1 | No fix listed |
| didier ernotte inforss | = 0.8.9.3 | No fix listed |
| didier ernotte inforss | = 0.8.9.4 | No fix listed |
| didier ernotte inforss | = 0.8.9.5 | No fix listed |
| didier ernotte inforss | = 0.9.0 | No fix listed |
| didier ernotte inforss | = 0.10.0 | No fix listed |
| didier ernotte inforss | = 0.10.1 | No fix listed |
| didier ernotte inforss | = 1.0.0 | No fix listed |
| didier ernotte inforss | = 1.1.0.1 | No fix listed |
| didier ernotte inforss | = 1.1.1 | No fix listed |
| didier ernotte inforss | = 1.1.2 | No fix listed |
| didier ernotte inforss | = 1.1.3 | No fix listed |
| didier ernotte inforss | = 1.1.4 | No fix listed |
| didier ernotte inforss | = 1.1.4.1 | No fix listed |
References
- 37467 third-party-advisory vendor-advisory
- ADV-2009-3323 vdb-entry vendor-advisory
- addons.mozilla.org
- inforss-rss-xss(54370) vdb-entry