Home > Vulnerability Database > CVE-2014-8638

Mend.io Vulnerability Database

CVE-2014-8638

Date: January 14, 2015

The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.

Severity Score

5.6

Related Resources (43)

Url: http://www.debian.org/security/2015/dsa-3132

Url: http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

Url: http://linux.oracle.com/errata/ELSA-2015-0046.html

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=1080987

Url: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html

Url: http://secunia.com/advisories/62283

Url: http://secunia.com/advisories/62242

Url: http://rhn.redhat.com/errata/RHSA-2015-0047.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2014-8638

Url: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html

Url: http://secunia.com/advisories/62304

Url: https://security.gentoo.org/glsa/201504-01

Url: http://secunia.com/advisories/62446

Url: http://secunia.com/advisories/62316

Url: http://secunia.com/advisories/62657

Url: http://www.securityfocus.com/bid/72047

Url: http://secunia.com/advisories/62418

Url: http://linux.oracle.com/errata/ELSA-2015-0047.html

Url: http://www.debian.org/security/2015/dsa-3127

Url: http://www.securitytracker.com/id/1031534

Url: http://www.securitytracker.com/id/1031533

Url: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html

Url: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html

Url: http://www.mozilla.org/security/announce/2014/mfsa2015-03.html

Url: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html

Url: http://secunia.com/advisories/62250

Url: http://secunia.com/advisories/62293

Url: http://secunia.com/advisories/62274

Url: https://nvd.nist.gov/vuln/detail/CVE-2014-8638

Url: http://rhn.redhat.com/errata/RHSA-2015-0046.html

Url: http://secunia.com/advisories/62790

Url: http://secunia.com/advisories/62273

Url: https://access.redhat.com/security/cve/CVE-2014-8638

Url: http://secunia.com/advisories/62253

Url: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/99958

Url: http://secunia.com/advisories/62313

Url: http://www.ubuntu.com/usn/USN-2460-1

Url: http://secunia.com/advisories/62315

Url: http://secunia.com/advisories/62259

Url: http://secunia.com/advisories/62237

Url: http://lists.opensuse.org/opensuse-updates/2015-01/msg00071.html

Url: https://www.mend.io/vulnerability-database/CVE-2014-8638

Severity Score

5.6

Weakness Type (CWE)

Cross-Site Request Forgery (CSRF)

CWE-352

CVSS v3.1

Base Score:	5.6
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	6.8
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2014-8638

Date: January 14, 2015

Severity Score

Related Resources (43)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?