CVE-2009-4102

CRITICAL 9.3CVE-2009-4102 · Published 29/11/2009 · updated 16/06/2026

In short

CVE-2009-4102 is a CRITICAL (CVSS 9.3) vulnerability affecting sage (sage.mozdev).
Chance of exploitation in the next 30 days (EPSS): 3.4%, higher than 88.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
sage sage.mozdev	`= 1.3.8≤ 1.4.3`	No fix yet

Description

Sage 1.4.3 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed.

References

forums.mozillazine.org/viewtopic.php
jvn.jp/en/jp/JVN99203127/index.html
jvndb.jvn.jp/jvndb/JVNDB-2011-000070
secunia.com/advisories/37466 · Vendor Advisory
debian.org/security/2009/dsa-1951
net-security.org/secworld.php
securityfocus.com/bid/37120
vupen.com/english/advisories/2009/3324 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/54396

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free