NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-thunderbirdamazon-linux-ami-2-upgrade-thunderbird-debuginfo | Apr 27, 2020 | Oct 18, 2018 | |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Oct 18, 2018 |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfo | Jul 13, 2018 | Jun 26, 2018 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-thunderbird | Jun 28, 2018 | Jun 26, 2018 | |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-waterfoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | Jun 27, 2018 | Jun 26, 2018 | |
| Gentoo Linux | gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Oct 3, 2018 | Oct 2, 2018 | |
| Mfsa2018 15 | mozilla-firefox-upgrade-61_0 | Jun 27, 2018 | Jun 26, 2018 | |
| Mfsa2018 16 | mozilla-firefox-esr-upgrade-60_1 | Jun 27, 2018 | Jun 26, 2018 | |
| Mfsa2018 17 | mozilla-firefox-esr-upgrade-52_9 | Jun 27, 2018 | Jun 26, 2018 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-60_0 | Jul 4, 2018 | Jul 3, 2018 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-mail-thunderbird-52-9-1-0-175-3-35-0-4-0oracle-solaris-11-3-upgrade-mail-thunderbird-plugin-thunderbird-lightning-52-9-1-0-175-3-35-0-4-0oracle-solaris-11-3-upgrade-web-browser-firefox-52-9-0-0-175-3-34-0-4-0oracle-solaris-11-3-upgrade-web-browser-firefox-plugin-firefox-java-52-9-0-0-175-3-34-0-4-0oracle-solaris-11-3-upgrade-web-data-firefox-bookmarks-52-9-0-0-175-3-34-0-4-0oracle-solaris-11-4-upgrade-database-mysql-57-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-mysql-57-client-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-mysql-57-embedded-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-mysql-57-library-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-mysql-57-tests-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-sqlite-3-3-24-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-sqlite-3-documentation-3-24-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-diagnostic-wireshark-2-6-3-11-4-1-0-1-2-0oracle-solaris-11-4-upgrade-diagnostic-wireshark-tshark-2-6-3-11-4-1-0-1-2-0oracle-solaris-11-4-upgrade-diagnostic-wireshark-wireshark-common-2-6-3-11-4-1-0-1-2-0oracle-solaris-11-4-upgrade-image-library-libjpeg-6-0-2-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-desktop-dotconf-1-3-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-desktop-speech-dispatcher-0-8-6-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-desktop-webkitgtk4-2-18-6-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-liblouis-3-5-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-authen-pam-5-8-4-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-authen-pam-522-0-16-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-authen-pam-526-0-16-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-cgi-4-37-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-cgi-522-4-37-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-cgi-526-4-37-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-database-1-636-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-database-522-1-636-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-database-526-1-636-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-mysql-4042-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-mysql-522-4042-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-mysql-526-4042-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-sqlite-1-58-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-sqlite-522-1-58-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-sqlite-526-1-58-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-gettext-1-0-7-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-gettext-522-1-0-7-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-gettext-526-1-0-7-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-net-ssleay-1-80-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-net-ssleay-522-1-80-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-net-ssleay-526-1-80-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-tk-522-804-33-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-tk-526-804-33-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-tk-804-33-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-x11-protocol-0-56-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-x11-protocol-522-0-56-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-x11-protocol-526-0-56-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-pmtools-2-0-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-pmtools-522-2-0-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-pmtools-526-2-0-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-libxml-2-128-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-libxml-522-2-128-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-libxml-526-2-128-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-namespacesupport-1-11-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-namespacesupport-522-1-11-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-namespacesupport-526-1-11-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-parser-5-12-1-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-parser-522-2-44-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-parser-526-2-44-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-0-99-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-522-0-99-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-526-0-99-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-base-1-8-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-base-522-1-8-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-base-526-1-8-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-simple-2-24-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-simple-522-2-24-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-simple-526-2-24-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-python-pyatspi2-2-18-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-python-pyatspi2-27-2-18-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-python-pyatspi2-34-2-18-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-python-pyatspi2-35-2-18-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-speech-espeak-1-44-0-5-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-mail-mailman-2-1-29-1-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-mail-thunderbird-52-9-1-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-mail-thunderbird-plugin-thunderbird-lightning-52-9-1-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-runtime-tcl-8-tcl-sqlite-3-3-24-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-system-display-manager-desktop-startup-0-38-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-system-display-manager-gdm-3-24-2-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-terminal-cssh-4-9-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-terminal-cssh-522-4-9-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-terminal-cssh-526-4-9-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-curl-7-61-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-8-5-32-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-32-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-32-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-dbd-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-gss-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ldap-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-lua-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-34-11-4-1-0-1-1-0 | Jul 18, 2018 | Jul 18, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | Jul 4, 2018 | Jun 26, 2018 |
| Redhat_linux | — | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginfo | Jun 29, 2018 | Jun 26, 2018 |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-branding-upstreamsuse-upgrade-mozillafirefox-buildsymbolssuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translationssuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-buildsymbolssuse-upgrade-mozillathunderbird-develsuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-othersuse-upgrade-seamonkeysuse-upgrade-seamonkey-translations-commonsuse-upgrade-seamonkey-translations-other | Jun 29, 2018 | Jun 26, 2018 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | Jul 12, 2018 | Jun 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub