CVE-2015-4520 — Improper Access Control in Mozilla Firefox

CWE-254CWE-284 — Improper Access Control15 documents6 sources
Severity
6.4MEDIUMNVD
OSV7.5
EPSS
0.6%
top 30.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla Thunderbird
Timeline
PublishedSep 24
Latest updateMay 17

Description

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header.

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 10.0 | Impact: 4.9

Affected Packages3 packages

▶Ubuntumozilla/firefox< 41.0+build3-0ubuntu0.14.04.1+1
▶NVDmozilla/firefox40.0.3+7
▶Ubuntumozilla/thunderbird< 1:38.3.0+build1-0ubuntu0.14.04.1

🔴Vulnerability Details

7
GHSA
GHSA-47pc-q6hv-5vfj: Mozilla Firefox before 41↗2022-05-17
▶
OSV
thunderbird vulnerabilities↗2015-10-05
▶
OSV
firefox regression↗2015-10-05
▶
OSV
unity-firefox-extension, webapps-greasemonkey, webaccounts-browser-extension update↗2015-09-24
▶
OSV
ubufox update↗2015-09-22
▶

📋Vendor Advisories

6
Ubuntu
Thunderbird vulnerabilities↗2015-10-05
▶
Ubuntu
Firefox regression↗2015-10-05
▶
Ubuntu
Unity Integration for Firefox, Unity Websites Integration and Ubuntu Online Accounts extension update↗2015-09-24
▶
Red Hat
Mozilla: Errors in the handling of CORS preflight request headers (MFSA 2015-111)↗2015-09-22
▶
Ubuntu
Ubufox update↗2015-09-22
▶

💬Community

1
Bugzilla
CVE-2015-4520 Mozilla: Errors in the handling of CORS preflight request headers (MFSA 2015-111)↗2015-09-23
▶