CVE-2015-2711

MEDIUM

Description

Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL, as demonstrated by a private path component.

References

http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html

http://www.mozilla.org/security/announce/2015/mfsa2015-49.html

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.securityfocus.com/bid/74611

http://www.ubuntu.com/usn/USN-2602-1

https://bugzilla.mozilla.org/show_bug.cgi?id=1113431

https://security.gentoo.org/glsa/201605-06

Details

Source: MITRE

Published: 2015-05-14

Updated: 2018-10-30

Type: CWE-200

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (8 total)

IDNameProductFamilySeverity
701255Mozilla Firefox ESR < 31.7 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
91379GLSA-201605-06 : Mozilla Products: Multiple vulnerabilities (Logjam) (SLOTH)NessusGentoo Local Security Checks
critical
8865Mozilla Firefox < 38.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
83801openSUSE Security Update : MozillaFirefox (openSUSE-2015-375)NessusSuSE Local Security Checks
critical
83439Firefox < 38.0 Multiple VulnerabilitiesNessusWindows
critical
83437Firefox < 38.0 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
high
83434Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : firefox vulnerabilities (USN-2602-1)NessusUbuntu Local Security Checks
high
83389FreeBSD : mozilla -- multiple vulnerabilities (d9b43004-f5fd-4807-b1d7-dbf66455b244)NessusFreeBSD Local Security Checks
critical