CVE-2013-1692

Mozilla Firefox < 22.0 and Firefox ESR 17.x < 17.0.7 - Cross-Site Request Forgery via XMLHttpRequest HEAD Request

Title source: llm

Description

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web site.

References (16)

Core 16

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0982.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1890-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=866915

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0981.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17096

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1891-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2013/dsa-2716

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/60783

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2013/dsa-2720

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2013/mfsa2013-54.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html

Scores

EPSS 0.0201

EPSS Percentile 78.7%

Details

CWE

CWE-264

Status published

Products (27)

mozilla/firefox 19.0

mozilla/firefox 19.0.1

mozilla/firefox 19.0.2

mozilla/firefox 20.0

mozilla/firefox 20.0.1

mozilla/firefox 17.0

mozilla/firefox 17.0.1

mozilla/firefox 17.0.2

mozilla/firefox 17.0.3

mozilla/firefox 17.0.4

... and 17 more

Published Jun 26, 2013

Tracked Since Feb 18, 2026