Improper authorization control for web services In devhelp
Description
The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a password, which allows remote attackers to obtain passwords via a password INPUT element on a different web page located on the web site intended for this password.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel5 | 0:1.5.0.10-2.el5 | ||
rpm rhel5 | 0:0.12-10.0.1.el5 | ||
rpm rhel5 | 0:1.5.0.10-1.el5 | ||
rpm rhel5 | 0:2.16.0-14.0.1.el5 |
Aliases
1. 2. 3.