Vulnetix
Try Vulnetix Request Demo
CVE-2014-8638 PUBLISHED

The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.

EPSS 0.50% · 65.6th percentile

Risk Scores

EPSS Score
0.50%
65.6th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSthunderbird1:31.3.0+build1-0ubuntu0.14.04.1, 0, 1:24.0+build1-0ubuntu1
Ubuntu:14.04:LTSfirefox0, 24.0+build1-0ubuntu1, 25.0+build3-0ubuntu0.13.10.1

Timeline

References

Open in Interactive Console →