VDB
GHSA-xj5m-432r-gpqm
GHSA-xj5m-432r-gpqm
PUBLISHED
Record from GitHub Advisory Database · Published May 17, 2022
The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Timeline
- May 17, 2022 CVE Published
- Apr 9, 2026 Distribution Patch
- Apr 9, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-xj5m-432r-gpqm
vulnetix vdb fixes GHSA-xj5m-432r-gpqmOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-xj5m-432r-gpqm/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1208339 url
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00021.html url
- http://www.mozilla.org/security/announce/2015/mfsa2015-115.html url
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html url
- https://nvd.nist.gov/vuln/detail/CVE-2015-7184 advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1212669 url
- http://www.securityfocus.com/bid/77100 url
- http://www.securitytracker.com/id/1033820 url
- http://www.ubuntu.com/usn/USN-2768-1 advisory