The navigator.sendBeacon implementation in Mozilla Firefox prior to 37.0, Firefox ESR 31.x prior to 31.6, and Thunderbird prior to 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote malicious users to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
mozilla firefox esr 31.5.3 |
||
mozilla firefox esr 31.0 |
||
mozilla firefox esr 31.4 |
||
mozilla firefox esr 31.5 |
||
mozilla firefox esr 31.1.1 |
||
mozilla firefox esr 31.2 |
||
mozilla thunderbird |
||
mozilla firefox esr 31.1 |
||
mozilla firefox esr 31.1.0 |
||
mozilla firefox esr 31.5.1 |
||
mozilla firefox esr 31.5.2 |
||
mozilla firefox |
||
mozilla firefox esr 31.3 |
||
mozilla firefox esr 31.3.0 |