NetSight
IP …
medium6.8

CVE-2015-0807

The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status cod…

Impact

The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.

Affected products

VendorProductAffected versions
MozillaFirefox
through 36.0.4
Versions 31.0, 31.1.0, 31.1.1, 31.3.0, 31.5.1
MozillaFirefox Esr
Versions 31.1, 31.2, 31.3, 31.4, 31.5
MozillaThunderbird
through 31.5

Weakness classification

CWE-352

References