CVE-2008-1238

Published: 27 March 2008

Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.

Status

References

• https://ubuntu.com/security/notices/USN-592-1
• https://www.cve.org/CVERecord?id=CVE-2008-1238
• NVD
• Launchpad
• Debian