Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade seamonkeyUpgrade thunderbirdUpgrade linux-firefox-develUpgrade linux-seamonkeyUpgrade flockUpgrade firefoxUpgrade linux-firefoxUpgrade linux-thunderbirdUpgrade linux-flockUpgrade linux-seamonkey-devel | Dec 10, 2025 | Mar 30, 2008 |
| Gentoo Linux | — | Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/mozilla-firefox.Upgrade mail-client/mozilla-thunderbird.Upgrade net-libs/xulrunner.Upgrade www-client/seamonkey. | Oct 30, 2017 | Mar 27, 2008 |
| Mfsa2008 16 | — | Upgrade to Mozilla Firefox version 2.0.0.13 | Jun 14, 2012 | Mar 27, 2008 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.9 | Feb 3, 2012 | Mar 27, 2008 |
| Oracle_linux | — | Upgrade firefoxUpgrade firefox-devel | Oct 16, 2024 | Mar 27, 2008 |
| Suse | — | Upgrade mozilla-huUpgrade mozilla-venkmanUpgrade MozillaFirefox-translationsUpgrade mozilla-calendarUpgrade mozillaUpgrade epiphany-docUpgrade mozilla-xulrunner181Upgrade mozilla-mailUpgrade seamonkey-mailUpgrade seamonkey-ircUpgrade mozilla-xulrunner181-32bitUpgrade epiphanyUpgrade suse-releaseUpgrade mozilla-xulrunner181-64bitUpgrade seamonkey-venkmanUpgrade seamonkey-spellcheckerUpgrade mozilla-deatUpgrade seamonkey-dom-inspectorUpgrade mozilla-xulrunner181-l10nUpgrade mozilla-csUpgrade seamonkeyUpgrade mozilla-dom-inspectorUpgrade epiphany-develUpgrade mozilla-xulrunner181-develUpgrade epiphany-extensionsUpgrade MozillaFirefoxUpgrade mozilla-ircUpgrade mozilla-devel | Feb 17, 2015 | Mar 27, 2008 |
| Ubuntu | — | Upgrade firefox | Nov 8, 2024 | Mar 27, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub