CVE-2015-4520 Security feature bypass in n/a

Medium 6.4 Published 24 Sep 2015 Updated 6 Aug 2024

Remote attackers can bypass CORS protections in Firefox via cache or header flaws, requiring user interaction to visit a malicious site.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2015-4520?

CVE-2015-4520 is a medium-severity vulnerability in Mozilla Firefox, published on 24 Sep 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header.

Weakness: CWE-254

Which versions are affected by CVE-2015-4520?

It affects 1 product.

Products include Mozilla Firefox.

How do I fix CVE-2015-4520?

Upgrade to a fixed version.

Is CVE-2015-4520 being exploited?

There is no known exploitation of CVE-2015-4520 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as GHSA-47pc-q6hv-5vfj, UBUNTU-CVE-2015-4520.