The Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri parameter of a violation report, which allows remote web servers to capture OpenID credentials and OAuth 2.0 access tokens by triggering a violation.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
21 Oct 2024, 13:55
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:mozilla:firefox_esr:10.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:10.0.1:*:*:*:*:*:*:* |
cpe:2.3:a:mozilla:firefox:10.0.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:10.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:10.0.2:*:*:*:*:*:*:* |
21 Oct 2024, 13:11
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:mozilla:firefox_esr:10.0.4:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:10.0.3:*:*:*:*:*:*:* |
cpe:2.3:a:mozilla:firefox:10.0.3:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:10.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:10.0.4:*:*:*:*:*:*:* |
Information
Published : 2012-07-18 10:26
Updated : 2024-10-21 13:55
NVD link : CVE-2012-1963
Mitre link : CVE-2012-1963
CVE.ORG link : CVE-2012-1963
JSON object : View
Products Affected
mozilla
- thunderbird_esr
- firefox
- seamonkey
- thunderbird
CWE
CWE-264
Permissions, Privileges, and Access Controls