NVD

Id
1198  
Name
CVE-2008-1238  
Description
Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-03  
Published
2008-03-27  
Modified Date
2011-03-07  
Seq
2008-1238  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
7617 1198 CVE-2008-1238 SUSE-SA:2008:019  View
7618 1198 CVE-2008-1238 oval:org.mitre.oval:def:9889  View
7619 1198 CVE-2008-1238 RHSA-2008:0208  View
7620 1198 CVE-2008-1238 http://sla.ckers.org/forum/read.php?10,20033  View
7621 1198 CVE-2008-1238 238492  View
7622 1198 CVE-2008-1238 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128  View
7623 1198 CVE-2008-1238 DSA-1532  View
7624 1198 CVE-2008-1238 DSA-1534  View
7625 1198 CVE-2008-1238 DSA-1535  View
7626 1198 CVE-2008-1238 GLSA-200805-18  View
7627 1198 CVE-2008-1238 MDVSA-2008:080  View
7628 1198 CVE-2008-1238 http://www.mozilla.org/security/announce/2008/mfsa2008-16.html  View
7629 1198 CVE-2008-1238 RHSA-2008:0207  View
7630 1198 CVE-2008-1238 RHSA-2008:0209  View
7631 1198 CVE-2008-1238 20080327 rPSA-2008-0128-1 firefox  View
7632 1198 CVE-2008-1238 28448  View
7633 1198 CVE-2008-1238 1019703  View
7634 1198 CVE-2008-1238 USN-592-1  View
7635 1198 CVE-2008-1238 TA08-087A  View
7636 1198 CVE-2008-1238 ADV-2008-0998  View
7637 1198 CVE-2008-1238 ADV-2008-1793  View
7638 1198 CVE-2008-1238 mozilla-http-referrer-spoofing(41449)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
45926 JVNDB-2008-001236 Mozilla Firefox/SeaMonkey におけるアプリケーションの防御メカニズムを回避される脆弱性 Mozilla Firefox/SeaMonkey には、HTTP Referer ヘッダを生成する際、Basic 認証に username がない場合、URL を適切に検査しないため、アプリケーションの防御メカニズムを回避される脆弱性が存在します。 CVE-2008-1238 31351 CVE-2008-1238 1198 5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001236.html 2008-03-25 2008-07-16 View