CVEvulnerability
CVE-2018-12364
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-10-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
Affected configurations
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.6
• redhat enterprise linux server eus 7.5
• redhat enterprise linux server eus 7.6
• redhat enterprise linux server tus 7.6
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
• debian debian linux 8.0
• debian debian linux 9.0
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 17.10
• canonical ubuntu linux 18.04
• mozilla firefox (< 61.0)
• mozilla firefox (>= 53.0 < 60.1.0)
• mozilla firefox esr (< 52.9)
• mozilla thunderbird (< 52.9)
• mozilla thunderbird (>= 52.9.1 < 60.0)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://www.securityfocus.com/bid/104560 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041193 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2112 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2113 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2251 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2252 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1436241 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/06/msg00014.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00013.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201810-01 Third Party Advisory
- https://security.gentoo.org/glsa/201811-13 Third Party Advisory
- https://usn.ubuntu.com/3705-1/ Third Party Advisory
- https://usn.ubuntu.com/3714-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4235 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4244 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-15/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-16/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-17/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-18/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-19/ Vendor Advisory
- http://www.securityfocus.com/bid/104560 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041193 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2112 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2113 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2251 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2252 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1436241 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/06/msg00014.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00013.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201810-01 Third Party Advisory
- https://security.gentoo.org/glsa/201811-13 Third Party Advisory
- https://usn.ubuntu.com/3705-1/ Third Party Advisory
- https://usn.ubuntu.com/3714-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4235 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4244 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-15/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-16/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-17/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-18/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-19/ Vendor Advisory