NVD

Id
35639  
Name
CVE-2014-8638  
Description
The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-01-14  
Modified Date
2017-01-02  
Seq
2014-8638  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
182480 35639 CVE-2014-8638 http://linux.oracle.com/errata/ELSA-2015-0046.html  View
182481 35639 CVE-2014-8638 http://linux.oracle.com/errata/ELSA-2015-0047.html  View
182482 35639 CVE-2014-8638 openSUSE-SU-2015:0077  View
182483 35639 CVE-2014-8638 SUSE-SU-2015:0171  View
182484 35639 CVE-2014-8638 SUSE-SU-2015:0173  View
182485 35639 CVE-2014-8638 SUSE-SU-2015:0180  View
182486 35639 CVE-2014-8638 openSUSE-SU-2015:0192  View
182487 35639 CVE-2014-8638 openSUSE-SU-2015:1266  View
182488 35639 CVE-2014-8638 openSUSE-SU-2015:0133  View
182489 35639 CVE-2014-8638 RHSA-2015:0046  View
182490 35639 CVE-2014-8638 RHSA-2015:0047  View
182491 35639 CVE-2014-8638 62253  View
182492 35639 CVE-2014-8638 62259  View
182493 35639 CVE-2014-8638 62273  View
182494 35639 CVE-2014-8638 62274  View
182495 35639 CVE-2014-8638 62283  View
182496 35639 CVE-2014-8638 62293  View
182497 35639 CVE-2014-8638 62304  View
182498 35639 CVE-2014-8638 62313  View
182499 35639 CVE-2014-8638 62315  View
182500 35639 CVE-2014-8638 62316  View
182501 35639 CVE-2014-8638 62418  View
182502 35639 CVE-2014-8638 DSA-3127  View
182503 35639 CVE-2014-8638 DSA-3132  View
182504 35639 CVE-2014-8638 http://www.mozilla.org/security/announce/2014/mfsa2015-03.html  View
182505 35639 CVE-2014-8638 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html  View
182506 35639 CVE-2014-8638 72047  View
182507 35639 CVE-2014-8638 1031533  View
182508 35639 CVE-2014-8638 1031534  View
182509 35639 CVE-2014-8638 USN-2460-1  View
182510 35639 CVE-2014-8638 firefox-cve20148638-csrf(99958)  View
182511 35639 CVE-2014-8638 https://bugzilla.mozilla.org/show_bug.cgi?id=1080987  View
182512 35639 CVE-2014-8638 GLSA-201504-01  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18713 JVNDB-2014-007588 複数の Mozilla 製品の navigator.sendBeacon の実装における CORS アクセス制御のチェックを回避される脆弱性 Mozilla Firefox、Thunderbird、および SeaMonkey の navigator.sendBeacon の実装は、CORS Origin ヘッダを省略するため、CORS アクセス制御のチェックを回避される、およびクロスサイトリクエストフォージェリ攻撃を実行される脆弱性が存在します。 CVE-2014-8638 75931 CVE-2014-8638 35639 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007588.html 2014-11-06 2015-05-12 View