PT-2015-4069 · Mozilla+5 · Firefox+8

Muneaki Nishimura

+1

·

Publicado

2015-01-13

·

Atualizado

2024-12-12

·

CVE-2014-8638

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 35.0 Firefox ESR versions 31.x prior to 31.4 Thunderbird versions prior to 31.4 SeaMonkey versions prior to 2.32
Description The issue allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, due to the omission of the CORS Origin header in the navigator.sendBeacon implementation.
Recommendations For Mozilla Firefox versions prior to 35.0, update to version 35.0 or later. For Firefox ESR versions 31.x prior to 31.4, update to version 31.4 or later. For Thunderbird versions prior to 31.4, update to version 31.4 or later. For SeaMonkey versions prior to 2.32, update to version 2.32 or later.

Exploit

Correção

CSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

ALT-PU-2015-1082
ALT-PU-2015-1112
ALT-PU-2015-1464
ALT-PU-2015-1584
CESA-2015_0046
CESA-2015_0047
CVE-2014-8638
DSA-3127-1
DSA-3132-1
MGASA-2015-0025
MGASA-2015-0028
OPENSUSE-SU-2015_0077-1
OPENSUSE-SU-2015_0077-2
OPENSUSE-SU-2015_0192-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:10230-1
OPENSUSE-SU-2024:14572-1
RHSA-2015:0046
RHSA-2015:0047
RHSA-2015_0046
RHSA-2015_0047
USN-2458-1
USN-2458-2
USN-2458-3
USN-2460-1

Produtos afetados

Alt Linux
Centos
Firefox Esr
Firefox
Red Hat
Seamonkey
Suse
Thunderbird
Ubuntu