VYPR
Unrated severityNVD Advisory· Published Nov 21, 2012· Updated Apr 29, 2026

CVE-2012-4205

CVE-2012-4205

Description

Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or obtain sensitive information by leveraging a sandboxed add-on.

Affected products

17
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
    Range: <17.0
  • cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
    Range: <2.14
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
    Range: <17.0
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
  • OpenSUSE/openSUSE3 versions
    cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
    • cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
    • cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
  • cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*+ 1 more
    • cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*
    • cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
  • cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*+ 2 more
    • cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
    • cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
    • cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
  • cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
    • cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

20

News mentions

0

No linked articles in our index yet.