CVE - CVE-2008-1238

CVE-ID
CVE-2008-1238	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:1019703 URL:http://www.securitytracker.com/id?1019703 MISC:20080327 rPSA-2008-0128-1 firefox URL:http://www.securityfocus.com/archive/1/490196/100/0/threaded MISC:238492 URL:~~http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1~~ (Obsolete source) MISC:28448 URL:http://www.securityfocus.com/bid/28448 MISC:29391 URL:http://secunia.com/advisories/29391 MISC:29526 URL:http://secunia.com/advisories/29526 MISC:29539 URL:http://secunia.com/advisories/29539 MISC:29541 URL:http://secunia.com/advisories/29541 MISC:29547 URL:http://secunia.com/advisories/29547 MISC:29550 URL:http://secunia.com/advisories/29550 MISC:29558 URL:http://secunia.com/advisories/29558 MISC:29560 URL:http://secunia.com/advisories/29560 MISC:29607 URL:http://secunia.com/advisories/29607 MISC:29616 URL:http://secunia.com/advisories/29616 MISC:29645 URL:http://secunia.com/advisories/29645 MISC:30327 URL:http://secunia.com/advisories/30327 MISC:30620 URL:http://secunia.com/advisories/30620 MISC:ADV-2008-0998 URL:~~http://www.vupen.com/english/advisories/2008/0998/references~~ (Obsolete source) MISC:ADV-2008-1793 URL:~~http://www.vupen.com/english/advisories/2008/1793/references~~ (Obsolete source) MISC:DSA-1532 URL:http://www.debian.org/security/2008/dsa-1532 MISC:DSA-1534 URL:http://www.debian.org/security/2008/dsa-1534 MISC:DSA-1535 URL:http://www.debian.org/security/2008/dsa-1535 MISC:GLSA-200805-18 URL:http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml MISC:MDVSA-2008:080 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2008:080~~ (Obsolete source) MISC:RHSA-2008:0207 URL:http://www.redhat.com/support/errata/RHSA-2008-0207.html MISC:RHSA-2008:0208 URL:http://rhn.redhat.com/errata/RHSA-2008-0208.html MISC:RHSA-2008:0209 URL:http://www.redhat.com/support/errata/RHSA-2008-0209.html MISC:SUSE-SA:2008:019 URL:http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html MISC:TA08-087A URL:http://www.us-cert.gov/cas/techalerts/TA08-087A.html MISC:USN-592-1 URL:http://www.ubuntu.com/usn/usn-592-1 MISC:http://sla.ckers.org/forum/read.php?10%2C20033 URL:http://sla.ckers.org/forum/read.php?10%2C20033 MISC:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128 URL:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128 MISC:http://www.mozilla.org/security/announce/2008/mfsa2008-16.html URL:http://www.mozilla.org/security/announce/2008/mfsa2008-16.html MISC:mozilla-http-referrer-spoofing(41449) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/41449 MISC:oval:org.mitre.oval:def:9889 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9889
Assigning CNA
Red Hat, Inc.
Date Record Created
20080310	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20080310)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)