« Volver al listado

CVE-2015-2711

Estado: ModificadaMedia (4.3)—

Mozilla Firefox anterior a 38.0 no reconoce una política de referer entregada por un elemento META del referer en casos de la navegación del menú contextual y la navegación por el botón central del ratón, lo que permite a atacantes remotos obtener información sensible mediante la lectura de los registros del Referer del servidor web que contienen datos privados en una URL, tal y como fue demostrado por un componente de ruta privada.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Mozilla — FirefoxOpensuse — Opensuse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-2711",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-05-14T10:59:04.430",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-49.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/74611",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2602-1",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1113431",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201605-06",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-49.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/74611",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2602-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1113431",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201605-06",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL, as demonstrated by a private path component."
    },
    {
      "lang": "es",
      "value": "Mozilla Firefox anterior a 38.0 no reconoce una política de referer entregada por un elemento META del referer en casos de la navegación del menú contextual y la navegación por el botón central del ratón, lo que permite a atacantes remotos obtener información sensible mediante la lectura de los registros del Referer del servidor web que contienen datos privados en una URL, tal y como fue demostrado por un componente de ruta privada."
    }
  ],
  "lastModified": "2026-06-17T00:24:35.853",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CF7EA41-388C-43CA-82A3-BBED9947CD49",
              "versionEndIncluding": "37.0.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}