CVE-2015-7215
Description
The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow.
Risk Information
Base Score
7.5
MODERATE
Vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.437
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Update for Mozilla Firefox (43.0) | Windows |
| Update for Mozilla Firefox (43.0.1) | Windows |
| Update for Mozilla Firefox (43.0.2) | Windows |
| Update for Mozilla Firefox (43.0.3) | Windows |
| Update for Mozilla Firefox x64 (43.0.3) | Windows |
| Update for Mozilla Firefox (43.0.4) | Windows |
| Update for Mozilla Firefox x64 (43.0.4) | Windows |
| Multiple Vulnerabilities are affected in Mozilla Firefox (x64) 42.0 | Windows |
| Multiple Vulnerabilities are affected in Mozilla_Firefox 42.0 | Windows |
| Multiple vulnerabilities are fixed in Update for Mozilla Firefox For Mac (43.0) | Mac |
| Multiple vulnerabilities are fixed in Update for Mozilla Firefox For Mac (43.0.1) | Mac |
| Multiple vulnerabilities are fixed in Update for Mozilla Firefox For Mac (43.0.2) | Mac |
| Multiple vulnerabilities are fixed in Update for Mozilla Firefox For Mac (43.0.4) | Mac |
| Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 42.0 | Mac |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-302188 | Update for Mozilla Firefox (43.0) |
| PATCH-302189 | Update for Mozilla Firefox (43.0.1) |
| PATCH-302190 | Update for Mozilla Firefox (43.0.2) |
| PATCH-302191 | Update for Mozilla Firefox (43.0.3) |
| PATCH-302192 | Update for Mozilla Firefox x64 (43.0.3) |
| PATCH-302193 | Update for Mozilla Firefox (43.0.4) |
| PATCH-302194 | Update for Mozilla Firefox x64 (43.0.4) |
| PATCH-607000 | Mozilla Firefox For Mac (124.0) |
| PATCH-607000 | Mozilla Firefox For Mac (124.0) |
| PATCH-607000 | Mozilla Firefox For Mac (124.0) |
| PATCH-607000 | Mozilla Firefox For Mac (124.0) |
| PATCH-611870 | Mozilla Firefox For Mac (142.0.1) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234