CVE-2005-4874 Information disclosure in n/a
Remote attackers can exploit HTTP TRACE support in Mozilla to obtain proxy or local server passwords, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2005-4874?
CVE-2005-4874 is a medium-severity vulnerability in Mozilla Mozilla, published on 28 Mar 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The XMLHttpRequest object in Mozilla 1.7.8 supports the HTTP TRACE method, which allows remote attackers to obtain (1) proxy authentication passwords via a request with a "Max-Forwards: 0" header or (2) arbitrary local passwords on the web server that hosts this object.
Weakness: CWE-94
Which versions are affected by CVE-2005-4874?
It affects 1 product.
Products include Mozilla Mozilla.
How do I fix CVE-2005-4874?
No fix has been published for CVE-2005-4874 yet. Limit exposure of the affected software until one is available.
Is CVE-2005-4874 being exploited?
There is no known exploitation of CVE-2005-4874 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Mozilla
Sources
Also known as GHSA-8m8j-89c8-3vh7.