Mozilla Foundation Security Advisory 2010-63

2010-09-10T00:00:00
ID SECURITYVULNS:DOC:24697
Type securityvulns
Reporter Securityvulns
Modified 2010-09-10T00:00:00

Description

Mozilla Foundation Security Advisory 2010-63

Title: Information leak via XMLHttpRequest statusText Impact: Low Announced: September 7, 2010 Reporter: Matt Haggard, Nicholas Berthaume Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1.3 Thunderbird 3.0.7 SeaMonkey 2.0.7 Description

Matt Haggard reported that the statusText property of an XMLHttpRequest object is readable by the requestor even when the request is made across origins. This status information reveals the presence of a web server and could be used to gather information about servers on internal private networks.

This issue was also independently reported to Mozilla by Nicholas Berthaume References

* https://bugzilla.mozilla.org/show_bug.cgi?id=552090
* CVE-2010-2764