CVE-2015-7184

Published: Oct 18, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

Affected (1)

Products: Mozilla: Firefox

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 41.0.1

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00021.html

Source: security@mozilla.org

http://www.mozilla.org/security/announce/2015/mfsa2015-115.html

Source: security@mozilla.org

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: security@mozilla.org

http://www.securityfocus.com/bid/77100

Source: security@mozilla.org

http://www.securitytracker.com/id/1033820

Source: security@mozilla.org

http://www.ubuntu.com/usn/USN-2768-1

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1208339

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1212669

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00021.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mozilla.org/security/announce/2015/mfsa2015-115.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/77100

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1033820

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2768-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=1208339

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=1212669

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.