CVE-2009-4101 describes a critical vulnerability in the infoRSS 1.1.4.2 and earlier Firefox extension, allowing remote attackers to execute arbitrary commands and conduct cross-domain scripting attacks. This is due to the extension performing operations with chrome privileges, exploitable via the description tag of an RSS feed. With a CVSS score of 9.3, this vulnerability has a high severity, indicating a network-based attack with medium complexity that could lead to complete compromise of confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, no publicly available exploit code in Metasploit or ExploitDB, and minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.1.4.2CPE matchmatch criteria | cpe:2.3:a:didier_ernotte:inforss:*:*:*:*:*:*:*:* | ||
0.5CPE matchmatch criteria | cpe:2.3:a:didier_ernotte:inforss:0.5:*:*:*:*:*:*:* | ||
0.7.7CPE matchmatch criteria | cpe:2.3:a:didier_ernotte:inforss:0.7.7:*:*:*:*:*:*:* | ||
0.8.4CPE matchmatch criteria | cpe:2.3:a:didier_ernotte:inforss:0.8.4:*:*:*:*:*:*:* | ||
0.8.7CPE matchmatch criteria | cpe:2.3:a:didier_ernotte:inforss:0.8.7:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.