CVE-2009-3006
Last modified
CVE-2009-3006 is a vulnerability of currently unknown severity. Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.. EPSS estimates a 1.05% chance of exploitation in the next 30 days.
Description
Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Maxthon | Maxthon Browser | 2.5.3.80 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-3006?
How severe is CVE-2009-3006?
How do I fix CVE-2009-3006?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-3000The sockfs module in the kernel in Sun Solaris 10 and OpenSo…
- CVE-2009-3001The llc_ui_getname function in net/llc/af_llc.c in the Linux…
- CVE-2009-3002The Linux kernel before 2.6.31-rc7 does not initialize certa…
- CVE-2009-3003Microsoft Internet Explorer 6 through 8 allows remote attack…
- CVE-2009-3004Avant Browser 11.7 Builds 35 and 36 allows remote attackers …
- CVE-2009-3005Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof t…
- CVE-2009-3007Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1,…
- CVE-2009-3008K-Meleon 1.5.3 allows context-dependent attackers to spoof t…
- CVE-2009-3009Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.…
- CVE-2009-3010Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7…
- CVE-2009-3011Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37…
- CVE-2009-3012Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7…
Are you affected by CVE-2009-3006?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST