The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mozilla
Published: 2015-10-18T10:00:00
Updated: 2024-08-06T07:43:44.916Z
Reserved: 2015-09-16T00:00:00
Link: CVE-2015-7184
Vulnrichment
No data.
NVD
Status : Modified
Published: 2015-10-18T10:59:03.703
Modified: 2016-12-24T02:59:36.200
Link: CVE-2015-7184
Redhat