PT-2008-2831 · Mozilla+1 · Firefox+2

CVE-2008-1238

·

Publicado

2008-03-27

·

Atualizado

2023-02-13

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 2.0.0.13 SeaMonkey versions prior to 1.1.9
Description The issue makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as some Cross-Site Request Forgery (CSRF) mechanisms, by not listing the entire URL when it contains Basic Authentication credentials without a username.
Recommendations For Mozilla Firefox versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For SeaMonkey versions prior to 1.1.9, update to version 1.1.9 or later.

Exploit

Correção

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-1238
DSA-1532-1
DSA-1534-1
DSA-1534-2
DSA-1535-1
RHSA-2008:0207
RHSA-2008:0208
RHSA-2008:0209
RHSA-2008_0207
RHSA-2008_0208
RHSA-2008_0209

Produtos afetados

Firefox
Red Hat
Seamonkey