CVE-2012-4205

Fixed in a distro release EPSS 2%

Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or obtain sensitive information by leveraging a sandboxed add-on.

Published 2012-11-21 · CVE record · OSV

Products: mozilla firefox, mozilla seamonkey, mozilla thunderbird, canonical ubuntu_linux, opensuse, suse linux_enterprise_desktop, suse linux_enterprise_server, suse linux_enterprise_software_development_kit

Distro releases