vulnerability
MFSA2016-13 Firefox: Same-origin-policy violation using Service Workers with plugins (CVE-2016-1949)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:M/Au:N/C:P/I:P/A:P) | Feb 11, 2016 | Feb 12, 2016 | Oct 30, 2017 |
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Feb 11, 2016
Added
Feb 12, 2016
Modified
Oct 30, 2017
Description
Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file.
Solution
mozilla-firefox-upgrade-44_0_2
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.