CVE-2012-4205
Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request…
Does this matter?
Lower severity and a low EPSS score (1.61%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or obtain sensitive information by leveraging a sandboxed add-on.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.61% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird · canonical/ubuntu linux · opensuse/opensuse · suse/linux enterprise desktop · suse/linux enterprise server · suse/linux enterprise software development kit
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.htmlMailing List, Third Party Advisory
- http://secunia.com/advisories/51369Broken Link
- http://secunia.com/advisories/51370Broken Link
- http://secunia.com/advisories/51381Broken Link
- http://secunia.com/advisories/51434Broken Link
- http://secunia.com/advisories/51439Broken Link
- http://secunia.com/advisories/51440Broken Link
- http://www.mozilla.org/security/announce/2012/mfsa2012-97.htmlVendor Advisory
- http://www.securityfocus.com/bid/56621Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1636-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1638-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1638-2Third Party Advisory
- http://www.ubuntu.com/usn/USN-1638-3Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=779821Issue Tracking, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80175Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16965Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.htmlMailing List, Third Party Advisory
- http://secunia.com/advisories/51369Broken Link
- http://secunia.com/advisories/51370Broken Link
- http://secunia.com/advisories/51381Broken Link
- http://secunia.com/advisories/51434Broken Link
- http://secunia.com/advisories/51439Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.