{"schemaVersion":3,"id":"CVE-2014-8638","aliases":["UBUNTU-CVE-2014-8638"],"status":"published","duplicateOf":null,"title":null,"description":"The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.","dates":{"published":"2015-01-14T11:00:00.000Z","modified":"2024-08-06T13:26:02.578Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0102,"percentile":0.62828,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0102},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0102,"percentile":0.62828}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0102,"percentile":0.62828}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","type":"weakness","status":"Stable","abstraction":"Compound","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/352.html"}],"affected":[{"vendor":"ubuntu","product":"firefox","name":"firefox","label":"firefox","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/firefox","purlType":"deb","versions":[{"text":"< 35.0+build3-0ubuntu0.14.04.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 35.0+build3-0ubuntu0.14.04.2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/thunderbird","purlType":"deb","versions":[{"text":"< 1:31.4.0+build1-0ubuntu0.14.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:31.4.0+build1-0ubuntu0.14.04.1","eol":null,"hubHref":null},{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"31.0","noFixRecorded":false,"fixedIn":null},{"text":"31.1.0","noFixRecorded":false,"fixedIn":null},{"text":"31.1.1","noFixRecorded":false,"fixedIn":null},{"text":"31.3.0","noFixRecorded":false,"fixedIn":null},{"text":"≤ 34.0.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"31.0 | 31.1.0 | 31.1.1 | 31.3.0 | ≤ 34.0.5","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"firefox_esr","name":"firefox esr","label":"firefox_esr","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"31.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"31.2","eol":null,"hubHref":"/vendor/mozilla/firefox_esr"},{"vendor":"mozilla","product":"seamonkey","name":"seamonkey","label":"seamonkey","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.31","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.31","eol":null,"hubHref":"/vendor/mozilla/seamonkey"},{"vendor":"mozilla","product":"thunderbird","name":"Thunderbird","label":"thunderbird","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 31.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 31.3.0","eol":null,"hubHref":"/vendor/mozilla/thunderbird"}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2015-0046.html","label":"rhn.redhat.com/errata/RHSA-2015-0046.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/62242","label":"secunia.com/advisories/62242","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securitytracker.com/id/1031533","label":"www.securitytracker.com/id/1031533","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://www.ubuntu.com/usn/USN-2460-1","label":"www.ubuntu.com/usn/USN-2460-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://www.securityfocus.com/bid/72047","label":"www.securityfocus.com/bid/72047","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html","label":"lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://secunia.com/advisories/62304","label":"secunia.com/advisories/62304","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://linux.oracle.com/errata/ELSA-2015-0047.html","label":"linux.oracle.com/errata/ELSA-2015-0047.html","hostname":"linux.oracle.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/62259","label":"secunia.com/advisories/62259","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/62250","label":"secunia.com/advisories/62250","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html","label":"lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://secunia.com/advisories/62237","label":"secunia.com/advisories/62237","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html","label":"lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://secunia.com/advisories/62418","label":"secunia.com/advisories/62418","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html","label":"lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1080987","label":"bugzilla.mozilla.org/show_bug.cgi?id=1080987","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/62316","label":"secunia.com/advisories/62316","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.debian.org/security/2015/dsa-3132","label":"www.debian.org/security/2015/dsa-3132","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://secunia.com/advisories/62274","label":"secunia.com/advisories/62274","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://security.gentoo.org/glsa/201504-01","label":"security.gentoo.org/glsa/201504-01","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://secunia.com/advisories/62313","label":"secunia.com/advisories/62313","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0047.html","label":"rhn.redhat.com/errata/RHSA-2015-0047.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.mozilla.org/security/announce/2014/mfsa2015-03.html","label":"www.mozilla.org/security/announce/2014/mfsa2015-03.html","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://secunia.com/advisories/62790","label":"secunia.com/advisories/62790","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/62293","label":"secunia.com/advisories/62293","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/62283","label":"secunia.com/advisories/62283","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/99958","label":"exchange.xforce.ibmcloud.com/vulnerabilities/99958","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://secunia.com/advisories/62446","label":"secunia.com/advisories/62446","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","label":"www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","hostname":"www.oracle.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/62657","label":"secunia.com/advisories/62657","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/62273","label":"secunia.com/advisories/62273","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-01/msg00071.html","label":"lists.opensuse.org/opensuse-updates/2015-01/msg00071.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html","label":"lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://www.debian.org/security/2015/dsa-3127","label":"www.debian.org/security/2015/dsa-3127","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html","label":"lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://secunia.com/advisories/62315","label":"secunia.com/advisories/62315","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://linux.oracle.com/errata/ELSA-2015-0046.html","label":"linux.oracle.com/errata/ELSA-2015-0046.html","hostname":"linux.oracle.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/62253","label":"secunia.com/advisories/62253","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securitytracker.com/id/1031534","label":"www.securitytracker.com/id/1031534","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"https://ubuntu.com/security/CVE-2014-8638","label":"ubuntu.com/security/CVE-2014-8638","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-GB/security/advisories/mfsa2015-03/","label":"www.mozilla.org/en-GB/security/advisories/mfsa2015-03/","hostname":"www.mozilla.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-2458-1","label":"ubuntu.com/security/notices/USN-2458-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2460-1","label":"ubuntu.com/security/notices/USN-2460-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8638","label":"www.cve.org/CVERecord?id=CVE-2014-8638","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":["DSA-3127-1","DSA-3132-1","MGASA-2015-0025","MGASA-2015-0028","OPENSUSE-SU-2024:10071-1","OPENSUSE-SU-2024:10230-1","OPENSUSE-SU-2024:14572-1","RHSA-2015:0046","RHSA-2015:0047","USN-2458-1","USN-2460-1"],"duplicates":[],"related":["OPENSUSE-SU-2024:10071-1","OPENSUSE-SU-2024:10230-1","OPENSUSE-SU-2024:14572-1","USN-2458-1","USN-2460-1"]},"timeline":[{"kind":"published","date":"2015-01-14T11:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T13:26:02.578Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":27,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T08:27:05.676Z","stale":false,"partial":false}}