Home > Vulnerability Database > CVE-2018-18506

Mend.io Vulnerability Database

CVE-2018-18506

Date: February 5, 2019

When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. This vulnerability affects Firefox < 65.

Language: Unix

Severity Score

5.9

Related Resources (26)

Url: https://access.redhat.com/errata/RHSA-2019:0680

Url: https://access.redhat.com/errata/RHSA-2019:0681

Url: https://seclists.org/bugtraq/2019/Apr/0

Url: https://seclists.org/bugtraq/2019/Mar/28

Url: https://www.debian.org/security/2019/dsa-4420

Url: https://lists.debian.org/debian-lts-announce/2019/04/msg00000.html

Url: https://usn.ubuntu.com/3874-1/

Url: https://nvd.nist.gov/vuln/detail/CVE-2018-18506

Url: https://access.redhat.com/errata/RHSA-2019:1144

Url: http://www.securityfocus.com/bid/106773

Url: https://lists.debian.org/debian-lts-announce/2019/03/msg00024.html

Url: https://access.redhat.com/security/cve/CVE-2018-18506

Url: https://www.mozilla.org/security/advisories/mfsa2019-01/

Url: https://security.gentoo.org/glsa/201904-07

Url: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00035.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2018-18506

Url: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00043.html

Url: https://security-tracker.debian.org/tracker/CVE-2018-18506

Url: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html

Url: https://usn.ubuntu.com/3927-1/

Url: https://www.debian.org/security/2019/dsa-4411

Url: https://access.redhat.com/errata/RHSA-2019:0966

Url: https://access.redhat.com/errata/RHSA-2019:0622

Url: https://access.redhat.com/errata/RHSA-2019:0623

Url: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00023.html

Url: https://www.mend.io/vulnerability-database/CVE-2018-18506

Severity Score

5.9

Weakness Type (CWE)

Security Features

CWE-254

Insufficient Information

NVD-CWE-noinfo

CVSS v3.1

Base Score:	5.9
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	HIGH
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2018-18506

Date: February 5, 2019

Language: Unix

Severity Score

Related Resources (26)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?