NetSight
IP …
medium6.5

CVE-2018-18494

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another sit…

Impact

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

Affected products

VendorProductAffected versions
MozillaFirefox
before 60.4.0
before 64.0
MozillaThunderbird
before 60.4.0
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 18.10
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Version 7.6
RedhatEnterprise Linux Server Eus
Version 7.6
RedhatEnterprise Linux Server Tus
Version 7.6
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0

Weakness classification

CWE-346

References