漏洞标题
N/A
漏洞描述信息
跨站点追踪发生在服务器通过追踪方法返回请求时，这允许XSS攻击访问授权头和无法由JavaScript访问的cookie(例如HTTPOnly加密的cookie)。为了减轻这种攻击，浏览器对<code>fetch()</code>和XMLHttpRequest设置了限制；然而，一些Web服务器已经实现了非标准头，如<code>X-Http-Method-Override</code>，可以覆盖HTTP方法，使这种攻击再次成为可能。 thunderbird 对此类和类似头的使用也应用了相同的减轻措施。此漏洞影响Firefox ESR<102.5, thunderbird<102.5, Firefox<107。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on <code>fetch()</code> and XMLHttpRequest; however some webservers have implemented non-standard headers such as <code>X-Http-Method-Override</code> that override the HTTP method, and made this attack possible again. Thunderbird has applied the same mitigations to the use of this and similar headers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Mozilla Firefox 跨站脚本漏洞
漏洞描述信息
Mozilla Firefox是美国Mozilla基金会的一款开源Web浏览器。 Mozila Firefox 存在安全漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
CVSS信息
N/A
漏洞类别
跨站脚本