Cross-Site Scripting Vulnerabilities in Gaia's Search App for Mozilla Firefox OS
CVE-2015-2745
Currently unrated
What is CVE-2015-2745?
Multiple cross-site scripting (XSS) vulnerabilities exist in the Search app within Gaia on Mozilla Firefox OS versions prior to 2.2. These vulnerabilities allow remote attackers to inject arbitrary HTML content. This occurs via the name or title fields in card content associated with a search link, which is improperly handled after specific user actions, such as pressing the HOME button or performing a Show Windows action. As a result, attackers could potentially embed malicious applications or spoof legitimate account-creation pages, leading to further exploitation.