CVE-2011-2369

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Mozilla Firefox 4.x through 4.0.1 and SeaMonkey 2.1, where the inline SVG feature improperly decodes HTML-encoded entities. The bug resides in the SVG innerHTML getter, which fails to encode entities, allowing script injection. The affected versions are those that introduced inline SVG support in the browser engine [1][2].

Exploitation

An attacker can exploit this by crafting an SVG element containing an HTML-encoded entity. No authentication or special privileges are required; the attacker only needs to deliver the malicious content to a victim, for example via a web page or email. When the browser processes the SVG element and calls the innerHTML getter, the entities are decoded, enabling arbitrary script execution [1][2].

Impact

Successful exploitation allows an attacker to inject arbitrary web script or HTML into the context of the victim's session. This can lead to information disclosure, session hijacking, or other malicious actions. The impact is rated as moderate by Mozilla [2].

Mitigation

The vulnerability is fixed in Firefox 5 and SeaMonkey 2.2, released on June 21, 2011. Users should upgrade to these versions. No workarounds are documented. Earlier versions of Firefox (3.x and below) are not affected [2]. This CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.