CVE-2006-2894
Medium
Description
Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allow user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.
SeverityMedium
CVSS4.0
Exploit probability—
Product
Mozilla Firefox
PublishedJun 7, 2006
First seenJun 7, 2006
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla firefox | v ≤ 2.0.0.8, 1.5.0.4 | — |
| mozilla mozilla_suite | 1.7.13 | — |
| mozilla seamonkey | v ≤ 1.1.4, 1.0.2 | — |
| netscape navigator | v ≤ 8.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.