5

CVE-2015-7207

Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a related issue to CVE-2015-1300.

Data is provided by the National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version <= 42.0
Opensuse ≫ Leap Version42.1
Opensuse ≫ Opensuse Version13.1
Opensuse ≫ Opensuse Version13.2
Opensuse ≫ Opensuse Version13.1
Fedoraproject ≫ Fedora Version22
Fedoraproject ≫ Fedora Version23
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.44% 0.621
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.