Description
toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to spoof an authorization dialog and capture credentials by demanding HTTP authentication in opportunistic circumstances.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/38918
Patch x_refsource_confirm
http://www.mozilla.org/security/announce/2010/mfsa2010-15.html
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8281
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:070
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/0692
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=537862
Scores
EPSS
0.0141
EPSS Percentile
69.7%
Details
Status
published
Products (1)
mozilla/firefox
3.6
Published
Mar 25, 2010
Tracked Since
Feb 18, 2026