QwikSec

Security Database

CVE

CWE

Training

CVE-2015-7184

Published: Oct 18, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

x_refsource_UBUNTU

http://www.mozilla.org/security/announce/2015/mfsa2015-115.html

x_refsource_CONFIRM

openSUSE-SU-2015:1817

vendor-advisory

x_refsource_SUSE

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

x_refsource_CONFIRM

https://bugzilla.mozilla.org/show_bug.cgi?id=1208339

x_refsource_CONFIRM

https://bugzilla.mozilla.org/show_bug.cgi?id=1212669

x_refsource_CONFIRM

vdb-entry

x_refsource_SECTRACK

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.