Description
Cross-site request forgery (CSRF) vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to hijack the authentication of arbitrary users for requests that were initiated by a plugin and received a 307 redirect to a page on a different web site.
References (8)
Core 8
Core References
Vendor Advisory x_refsource_confirm
http://support.avaya.com/css/P8/documents/100128655
Various Sources x_refsource_confirm
http://downloads.avaya.com/css/P8/documents/100133195
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/46652
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2011/mfsa2011-10.html
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0313.html
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:041
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=573873
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14473
Scores
EPSS
0.0097
EPSS Percentile
57.6%
Details
CWE
CWE-352
Status
published
Products (47)
mozilla/firefox
3.6
mozilla/firefox
3.6.2
mozilla/firefox
3.6.3
mozilla/firefox
3.6.4
mozilla/firefox
3.6.6
mozilla/firefox
3.6.7
mozilla/firefox
3.6.8
mozilla/firefox
3.6.9
mozilla/firefox
3.6.10
mozilla/firefox
3.6.11
... and 37 more
Published
Mar 02, 2011
Tracked Since
Feb 18, 2026