PT-2018-3591 · Mozilla+5 · Firefox+5
Tony Paloma
·
Publicado
2018-02-23
·
Atualizado
2024-12-12
·
CVE-2018-5131
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox ESR versions prior to 52.7
Firefox versions prior to 59
Description
The issue is related to the "fetch()" API, which under certain circumstances can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header, instead of downloading a copy from the network. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing. The vulnerability can be exploited by a remote attacker to gain unauthorized access to protected information.
Recommendations
For Firefox ESR versions prior to 52.7, update to version 52.7 or later.
For Firefox versions prior to 59, update to version 59 or later.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Firefox
Red Hat
Suse
Ubuntu