Every CVE Search/ Get API key

CVE-2008-4582

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13...

4.3 MediumPublic exploit

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

Exploit likelihood

10.2%Down 2.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

Record
CVE-2008-4582
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

Record
CVE-2008-4582
Updated
2026-11-02
EUVDEUVD-2008-4562 No score

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

Record
EUVD-2008-4562
Updated
2026-11-03
GitHub AdvisoriesGHSA-6m7x-v5gc-rvvh No score

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13...

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

Record
GHSA-6m7x-v5gc-rvvh
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xulrunner
Debian:4.0
From an advisory covering 28 CVEs
 before 1.8.0.15~pre080614h-0etch1, plus listed versions
1.8.0.11-21.8.0.11-31.8.0.11-41.8.0.11-4.11.8.0.12-0etch1
Show 12 moreShow less
1.8.0.13~pre070720-0etch11.8.0.13~pre070720-0etch21.8.0.13~pre070720-0etch31.8.0.13~pre070720-0etch3+lenny11.8.0.14~pre071019b-0etch11.8.0.14~pre071019b-0lenny11.8.0.14~pre071019c-0etch11.8.0.15~pre080131a-0etch11.8.0.15~pre080131b-0etch11.8.0.15~pre080323b-0etch11.8.0.15~pre080323b-0etch21.8.0.15~pre080614d-0etch1
1.8.0.15~pre080614h-0etch1
iceweasel
Debian:4.0
From an advisory covering 13 CVEs
 before 2.0.0.18-0etch1, plus listed versions
2.0.0.10-0etch12.0.0.10-12.0.0.10-22.0.0.11-12.0.0.12-0etch1
Show 27 moreShow less
2.0.0.12-12.0.0.12-22.0.0.13-0etch12.0.0.13-12.0.0.14-0etch12.0.0.14-12.0.0.14-22.0.0.15-0etch12.0.0.16-0etch12.0.0.17-0etch12.0.0.3-12.0.0.3-22.0.0.4-0etch12.0.0.4-12.0.0.5-0etch12.0.0.5-0etch1+lenny12.0.0.5-12.0.0.5-22.0.0.6+2.0.0.8-0etch12.0.0.6-0etch12.0.0.6-0etch1+lenny12.0.0.6-12.0.0.7-12.0.0.7-22.0.0.8-12.0.0.9-12.0.0.9-2
2.0.0.18-0etch1
icedove
Debian:4.0
From an advisory covering 28 CVEs
 before 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, plus listed versions
1.5.0.10.dfsg1-31.5.0.12.dfsg1-0etch11.5.0.12.dfsg1-0etch1+lenny11.5.0.13+1.5.0.14b.dfsg1-0etch11.5.0.13+1.5.0.14b.dfsg1-0lenny1
Show 5 moreShow less
1.5.0.13+1.5.0.15a.dfsg1-0etch11.5.0.13+1.5.0.15b.dfsg1+prepatch080417a-0etch11.5.0.13+1.5.0.15b.dfsg1+prepatch080614d-0etch11.5.0.13+1.5.0.15b.dfsg1-0etch11.5.0.13+1.5.0.15b.dfsg1-0etch2
1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1
iceape
Debian:4.0
From an advisory covering 47 CVEs
 before 1.0.13~pre080614i-0etch1, plus listed versions
1.0.10~pre070720-0etch11.0.10~pre070720-0etch1+lenny11.0.10~pre070720-0etch31.0.10~pre070720-0etch3+lenny11.0.11~pre071022-0etch1
Show 8 moreShow less
1.0.11~pre071022-0etch1+lenny11.0.12~pre080131b-0etch11.0.12~pre080131b-0etch21.0.13~pre080323b-0etch11.0.13~pre080323b-0etch21.0.13~pre080323b-0etch31.0.8-41.0.9-0etch1
1.0.13~pre080614i-0etch1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMozilla Firefox 3.0.3 - Internet Shortcut Same Origin Policy Violation2008-10-07

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-4582 is a medium vulnerability (CVSS 4.3) in Mozilla Firefox, published October 15, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.2%, the 95th percentile. No source names a fixed version.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open