CVE-2015-0807 in Mozilla Firefox
Summary
The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
01/07/2015
Disclosure
04/01/2015
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 74507 | Mozilla Firefox/Thunderbird CORS Redirect cross-site request forgery | 352 | High | Official fix | CVE-2015-0807 |