CVE-2012-0455

Name: CVE-2012-0455
Creator: NVD / NIST
Published: 2012-03-14T19:55:01.837+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.78%

Last modified Jun 16, 2026

CVE-2012-0455 is a vulnerability of currently unknown severity. Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict drag-and-drop operations on javascript: URLs, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a "DragAndDropJacking" issue.. EPSS estimates a 1.78% chance of exploitation in the next 30 days.

Description

Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict drag-and-drop operations on javascript: URLs, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a "DragAndDropJacking" issue.

Metrics

EPSS Probability

1.78%

75.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions	Update
Mozilla	Firefox	<= 3.6.27	—
Mozilla	Firefox	4.0	—
Mozilla	Firefox	4.0.1	—
Mozilla	Firefox	5.0	—
Mozilla	Firefox	5.0.1	—
Mozilla	Firefox	6.0	—
Mozilla	Firefox	6.0.1	—
Mozilla	Firefox	6.0.2	—
Mozilla	Firefox	7.0	—
Mozilla	Firefox	7.0.1	—
Mozilla	Firefox	8.0	—
Mozilla	Firefox	8.0.1	—
Mozilla	Firefox	9.0	—
Mozilla	Firefox	9.0.1	—
Mozilla	Firefox	10.0	—
Mozilla	Firefox Esr	10.1	—
Mozilla	Firefox Esr	10.2	—
Mozilla	Thunderbird	<= 3.1.19	—
Mozilla	Thunderbird	5.0	—
Mozilla	Thunderbird	6.0	—
Mozilla	Thunderbird	6.0.1	—
Mozilla	Thunderbird	6.0.2	—
Mozilla	Thunderbird	8.0	—
Mozilla	Thunderbird	9.0	—
Mozilla	Thunderbird	9.0.1	—
Mozilla	Thunderbird Esr	10.0	—
Mozilla	Thunderbird Esr	10.0.1	—
Mozilla	Thunderbird Esr	10.0.2	—
Mozilla	Seamonkey	<= 2.7	Beta5

References

http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html
http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0387.html
http://rhn.redhat.com/errata/RHSA-2012-0388.html
http://secunia.com/advisories/48359
http://secunia.com/advisories/48402
http://secunia.com/advisories/48414
http://secunia.com/advisories/48495Third Party Advisory
http://secunia.com/advisories/48496Third Party Advisory
http://secunia.com/advisories/48513Third Party Advisory
http://secunia.com/advisories/48553Third Party Advisory
http://secunia.com/advisories/48561Third Party Advisory
http://secunia.com/advisories/48624Third Party Advisory
http://secunia.com/advisories/48629Third Party Advisory
http://secunia.com/advisories/48823Third Party Advisory
http://secunia.com/advisories/48920Third Party Advisory
http://www.debian.org/security/2012/dsa-2433Third Party Advisory
http://www.debian.org/security/2012/dsa-2458
http://www.mandriva.com/security/advisories?name=MDVSA-2012:031
http://www.mandriva.com/security/advisories?name=MDVSA-2012:032
http://www.mozilla.org/security/announce/2012/mfsa2012-13.htmlVendor Advisory
http://www.securityfocus.com/bid/52458
http://www.securitytracker.com/id?1026801
http://www.securitytracker.com/id?1026803
http://www.securitytracker.com/id?1026804
http://www.ubuntu.com/usn/USN-1400-1
http://www.ubuntu.com/usn/USN-1400-2Third Party Advisory
http://www.ubuntu.com/usn/USN-1400-3Third Party Advisory
http://www.ubuntu.com/usn/USN-1400-4Third Party Advisory
http://www.ubuntu.com/usn/USN-1400-5Third Party Advisory
http://www.ubuntu.com/usn/USN-1401-1Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=704354Issue Tracking, Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14829Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html
http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0387.html
http://rhn.redhat.com/errata/RHSA-2012-0388.html
http://secunia.com/advisories/48359
http://secunia.com/advisories/48402
http://secunia.com/advisories/48414
http://secunia.com/advisories/48495Third Party Advisory
http://secunia.com/advisories/48496Third Party Advisory
http://secunia.com/advisories/48513Third Party Advisory
http://secunia.com/advisories/48553Third Party Advisory
http://secunia.com/advisories/48561Third Party Advisory
http://secunia.com/advisories/48624Third Party Advisory
http://secunia.com/advisories/48629Third Party Advisory
http://secunia.com/advisories/48823Third Party Advisory
http://secunia.com/advisories/48920Third Party Advisory
http://www.debian.org/security/2012/dsa-2433Third Party Advisory
http://www.debian.org/security/2012/dsa-2458
http://www.mandriva.com/security/advisories?name=MDVSA-2012:031
http://www.mandriva.com/security/advisories?name=MDVSA-2012:032
http://www.mozilla.org/security/announce/2012/mfsa2012-13.htmlVendor Advisory
http://www.securityfocus.com/bid/52458
http://www.securitytracker.com/id?1026801
http://www.securitytracker.com/id?1026803
http://www.securitytracker.com/id?1026804
http://www.ubuntu.com/usn/USN-1400-1
http://www.ubuntu.com/usn/USN-1400-2Third Party Advisory
http://www.ubuntu.com/usn/USN-1400-3Third Party Advisory
http://www.ubuntu.com/usn/USN-1400-4Third Party Advisory
http://www.ubuntu.com/usn/USN-1400-5Third Party Advisory
http://www.ubuntu.com/usn/USN-1401-1Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=704354Issue Tracking, Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14829Third Party Advisory

Timeline

Published: Mar 14, 2012
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2012-0455?

How severe is CVE-2012-0455?

Severity scoring for CVE-2012-0455 is pending analysis. The EPSS model estimates a 1.78% probability of exploitation in the next 30 days.

How do I fix CVE-2012-0455?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-0455?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST