QwikSec

Security Database

CVE

CWE

Training

CVE-2011-2990

Published: Aug 18, 2011

Modified: Aug 6, 2024

PUBLISHED

Description

The implementation of Content Security Policy (CSP) violation reports in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not remove proxy-authorization credentials from the listed request headers, which allows attackers to obtain sensitive information by reading a report, related to incorrect host resolution that occurs with certain redirects.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

oval:org.mitre.oval:def:14458

vdb-entry

signature

x_refsource_OVAL

http://www.mozilla.org/security/announce/2011/mfsa2011-33.html

x_refsource_CONFIRM

https://bugzilla.mozilla.org/show_bug.cgi?id=664983

x_refsource_CONFIRM

https://bugzilla.mozilla.org/show_bug.cgi?id=679588

x_refsource_CONFIRM

SUSE-SA:2011:037

vendor-advisory

x_refsource_SUSE

http://www.mozilla.org/security/announce/2011/mfsa2011-29.html

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.