CVE-2014-8638 The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remo...
MediumCVSS 6.8
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | = 31.0 | No fix listed |
| mozilla Firefox | = 31.1.0 | No fix listed |
| mozilla Firefox | = 31.1.1 | No fix listed |
| mozilla Firefox | = 31.3.0 | No fix listed |
| mozilla Firefox | <= 34.0.5 | No fix listed |
| mozilla firefox esr | = 31.2 | No fix listed |
| mozilla Thunderbird | <= 31.3.0 | No fix listed |
| mozilla seamonkey | <= 2.31 | No fix listed |
References
- linux.oracle.com
- linux.oracle.com
- openSUSE-SU-2015:0077 vendor-advisory
- SUSE-SU-2015:0171 vendor-advisory
- SUSE-SU-2015:0173 vendor-advisory
- SUSE-SU-2015:0180 vendor-advisory
- openSUSE-SU-2015:0192 vendor-advisory
- openSUSE-SU-2015:1266 vendor-advisory
- openSUSE-SU-2015:0133 vendor-advisory
- RHSA-2015:0046 vendor-advisory
- RHSA-2015:0047 vendor-advisory
- 62237 third-party-advisory
- 62242 third-party-advisory
- 62250 third-party-advisory
- 62253 third-party-advisory
- 62259 third-party-advisory
- 62273 third-party-advisory
- 62274 third-party-advisory
- 62283 third-party-advisory
- 62293 third-party-advisory
- 62304 third-party-advisory
- 62313 third-party-advisory
- 62315 third-party-advisory
- 62316 third-party-advisory
- 62418 third-party-advisory
- 62446 third-party-advisory
- 62657 third-party-advisory
- 62790 third-party-advisory
- DSA-3127 vendor-advisory
- DSA-3132 vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- 72047 vdb-entry
- 1031533 vdb-entry
- 1031534 vdb-entry
- USN-2460-1 vendor-advisory
- bugzilla.mozilla.org
- firefox-cve20148638-csrf(99958) vdb-entry
- GLSA-201504-01 vendor-advisory