CVE-2015-4483 : Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed

Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request.

Published 2015-08-16 01:59:11

Updated 2018-10-30 16:27:36

Source Mozilla Corporation

View at NVD, CVE.org

Products affected by CVE-2015-4483

Oracle » Solaris » Version: 11.3
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox
Versions up to, including, (<=) 39.0.3
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Matching versions
Opensuse » Opensuse » Version: 13.2
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
Matching versions
Opensuse » Opensuse » Version: 13.1
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 59 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html

[security-announce] openSUSE-SU-2015:1390-1: important: Security update
Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Oracle Solaris Bulletin - April 2016
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html

[security-announce] openSUSE-SU-2015:1389-1: important: Security update
Third Party Advisory

CVEs referencing this url
http://www.mozilla.org/security/announce/2015/mfsa2015-86.html

Feed protocol with POST bypasses mixed content protections — Mozilla
Vendor Advisory
https://security.gentoo.org/glsa/201605-06

Mozilla Products: Multiple vulnerabilities (GLSA 201605-06) — Gentoo security

CVEs referencing this url
https://bugzilla.mozilla.org/show_bug.cgi?id=1148732

1148732 - (CVE-2015-4483) feed: protocol + POST method => mixed scripting
Issue Tracking
http://www.securityfocus.com/bid/76510

Mozilla Firefox CVE-2015-4483 Man in the Middle Security Bypass Vulnerability
http://www.securitytracker.com/id/1033247

Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Obtain Potentially Sensitive Information, Bypass Security Restrictions, and Conduct Cross-Site Scripting Attacks - SecurityTrack

CVEs referencing this url

Jump to