CVE-2015-4520
Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header.
- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-254
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mozilla:firefox
References
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00007.html