CVE-2015-7184
firefox: cross-origin restriction bypass using Fetch
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · October 15, 2015
Updated · November 21, 2025
Description
The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Statement
This issue did not affect the versions of firefox as shipped with Red Hat Enterprise Linux 5, 6, and 7.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-358 · Improperly Implemented Security Check for Standard