GHSA-h77x-2hj5-ggjw

GHSA-h77x-2hj5-ggjw PUBLISHED CVSS 5.099999904632568 MEDIUM

Record from GitHub Advisory Database · Published May 17, 2022

The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.

Risk scores

CVSS 4.0

5.099999904632568

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Timeline

May 17, 2022 CVE Published
Apr 9, 2026 Security Advisory
Apr 29, 2026 Distribution Patch (4 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-h77x-2hj5-ggjw
vulnetix vdb fixes GHSA-h77x-2hj5-ggjw

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-h77x-2hj5-ggjw/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →