6.8

CVE-2012-4205

Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or obtain sensitive information by leveraging a sandboxed add-on.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version < 17.0
Mozilla ≫ Seamonkey Version < 2.14
Mozilla ≫ Thunderbird Version < 17.0
Canonical ≫ Ubuntu Linux Version10.04
Canonical ≫ Ubuntu Linux Version11.10
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version12.10
Opensuse ≫ Opensuse Version11.4
Opensuse ≫ Opensuse Version12.1
Opensuse ≫ Opensuse Version12.2
Suse ≫ Linux Enterprise Desktop Version10 Updatesp4 SwEdition-
Suse ≫ Linux Enterprise Desktop Version11 Updatesp2
Suse ≫ Linux Enterprise Server Version10 Updatesp4 SwEdition-
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwPlatform-
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwPlatformvmware
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.61% 0.728
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html
Third Party Advisory
Mailing List
http://secunia.com/advisories/51369
Broken Link
http://secunia.com/advisories/51370
Broken Link
http://secunia.com/advisories/51381
Broken Link
http://secunia.com/advisories/51434
Broken Link
http://secunia.com/advisories/51439
Broken Link
http://secunia.com/advisories/51440
Broken Link
http://www.ubuntu.com/usn/USN-1636-1
Third Party Advisory
http://www.ubuntu.com/usn/USN-1638-1
Third Party Advisory
http://www.ubuntu.com/usn/USN-1638-2
Third Party Advisory
http://www.ubuntu.com/usn/USN-1638-3
Third Party Advisory
http://www.mozilla.org/security/announce/2012/mfsa2012-97.html
Vendor Advisory
http://www.securityfocus.com/bid/56621
Third Party Advisory
VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=779821
Vendor Advisory
Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/80175
Third Party Advisory
VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16965
Third Party Advisory