CVE-2018-12402: canonical ubuntu_linux Origin Validation Error
Vulnerability summary
CVE-2018-12402 is a medium (CVSS 6.5) Origin Validation Error vulnerability in canonical ubuntu_linux. EPSS estimates a 1.32% chance of exploitation in the next 30 days, higher than 70.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 28-02-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resources otherwise unreachable to the malicious page, if they can convince the visitor to save the complete web page. Similarly, SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page, which can result in saving the wrong version of resources based on those cookies. This vulnerability affects Firefox < 63.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.32%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.32% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu3 products
- firefox< 63.0+build2-0ubuntu0.14.04.2 | < 63.0+build2-0ubuntu0.16.04.2 | < 63.0+build2-0ubuntu0.18.04.2
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Mozilla1 product
- firefox≥ unspecified, < 63 | < 63.0
3 vendors · 5 products
References
10 links- bugzilla.mozilla.org/show_bug.cgi?id=1469916X Refsource CONFIRMIssue TrackingPermissions RequiredVendor Advisory
- bugzilla.mozilla.org/show_bug.cgi?id=1447087X Refsource CONFIRMIssue TrackingPermissions RequiredVendor Advisory