NetSight
IP …
medium6.8

CVE-2014-8638

The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits …

Impact

The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.

Affected products

VendorProductAffected versions
MozillaFirefox
through 34.0.5
Versions 31.0, 31.1.0, 31.1.1, 31.3.0
MozillaFirefox Esr
Version 31.2
MozillaThunderbird
through 31.3.0
MozillaSeamonkey
through 2.31

Weakness classification

CWE-352

References