| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | ≤ 2.0.0.12 | |
| seamonkey | ≤ 1.1.8 |
Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free