CVE-2016-5288

Description

Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2.

CVSS Metrics

• v3.0•MEDIUM•Score: 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.72%• Percentile: 73%

Techniques & Countermeasures

• CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

  The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

• mozilla•firefox

  < 49.0.2 | ≥ unspecified, < 49.0.2

References (4)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1310183
• https://www.mozilla.org/security/advisories/mfsa2016-87/
• http://www.securityfocus.com/bid/93810
• http://www.securitytracker.com/id/1037077