NVD

Id
23247  
Name
CVE-2015-0807  
Description
The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-04-01  
Modified Date
2017-01-02  
Seq
2015-0807  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
123262 23247 CVE-2015-0807 openSUSE-SU-2015:0677  View
123263 23247 CVE-2015-0807 SUSE-SU-2015:0704  View
123264 23247 CVE-2015-0807 openSUSE-SU-2015:0892  View
123265 23247 CVE-2015-0807 openSUSE-SU-2015:1266  View
123266 23247 CVE-2015-0807 RHSA-2015:0766  View
123267 23247 CVE-2015-0807 RHSA-2015:0771  View
123268 23247 CVE-2015-0807 DSA-3211  View
123269 23247 CVE-2015-0807 DSA-3212  View
123270 23247 CVE-2015-0807 http://www.mozilla.org/security/announce/2015/mfsa2015-37.html  View
123271 23247 CVE-2015-0807 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html  View
123272 23247 CVE-2015-0807 73457  View
123273 23247 CVE-2015-0807 1031996  View
123274 23247 CVE-2015-0807 1032000  View
123275 23247 CVE-2015-0807 USN-2550-1  View
123276 23247 CVE-2015-0807 USN-2552-1  View
123277 23247 CVE-2015-0807 https://bugzilla.mozilla.org/show_bug.cgi?id=1111834  View
123278 23247 CVE-2015-0807 GLSA-201512-10  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6711 JVNDB-2015-002031 Mozilla Firefox および Thunderbird の navigator.sendBeacon 実装におけるCORS アクセス制御チェックを回避される脆弱性 Mozilla Firefox および Thunderbird の navigator.sendBeacon 実装は、プリフライトリクエストが発生した後にリダイレクト用の HTTP 30x ステータスコードを処理するため、CORS アクセス制御チェックを回避され、クロスサイトリクエストフォージェリ攻撃を実行される脆弱性が存在します。 CVE-2015-0807 78018 CVE-2015-0807 23247 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002031.html 2015-03-31 2015-04-10 View