What is the CVSS score of CVE-2015-0816?

CVE-2015-0816 has a CVSS 2.0 base score of 5.0 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 85.4%.

Is there a public PoC exploit available for CVE-2015-0816?

Yes, a public proof-of-concept exploit is available for CVE-2015-0816. Prioritise patching immediately. EPSS: 85.4%.

Firefox CVE-2015-0816

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2015-04-01 security@mozilla.org

Mozilla Privilege Escalation Google Firefox Thunderbird Chrome

5.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:N/I:P/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Apr 01, 2015 - 10:59 cve.org

MEDIUM 5.0

DescriptionCVE.org

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.

AnalysisAI

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.4%.

Technical ContextAI

This vulnerability is classified under CWE-264. Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js. Affected products include: Mozilla Firefox, Mozilla Thunderbird. Version information: before 37.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.