CVE-2012-5841 describes a cross-site scripting (XSS) vulnerability in Mozilla Firefox (before 17.0), Firefox ESR (before 10.0.11), Thunderbird (before 17.0), Thunderbird ESR (before 10.0.11), and SeaMonkey (before 2.14). The flaw stems from insufficient restriction of write actions in cross-origin wrappers, allowing remote attackers to inject malicious scripts via crafted websites. With a CVSS score of 4.3, this vulnerability is of medium complexity and requires user interaction (AC:M) but does not require authentication (Au:N), leading to potential integrity impact (I:P) without affecting confidentiality or availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, indicating a low current threat landscape.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.0.11CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | ||
< 17.0CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | ||
< 2.14CPE matchmatch criteria | cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* | ||
< 17.0CPE matchmatch criteria | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | ||
< 10.0.11CPE matchmatch criteria | cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.