Rapid7 Vulnerability & Exploit Database

MFSA2014-03 SeaMonkey: UI selection timeout missing on download prompts (CVE-2014-1480)

Back to Search

MFSA2014-03 SeaMonkey: UI selection timeout missing on download prompts (CVE-2014-1480)

Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
02/06/2014
Created
07/25/2018
Added
12/08/2014
Modified
05/09/2019

Description

The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.

Solution(s)

  • mozilla-seamonkey-upgrade-2_24_0

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;