What’s Vulnerable › Vulnerabilities

CVE-2008-1238

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2008-03-27 · updated 2026-06-16
• Weakness: CWE-287

Description

Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.

Affected products

• Mozilla Firefox: through 2.0.0.12
• Mozilla Seamonkey: through 1.1.8

References

• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html
• http://rhn.redhat.com/errata/RHSA-2008-0208.html
• http://secunia.com/advisories/29391
• http://secunia.com/advisories/29526
• http://secunia.com/advisories/29539
• http://secunia.com/advisories/29541
• http://secunia.com/advisories/29547
• http://secunia.com/advisories/29550
• http://secunia.com/advisories/29558
• http://secunia.com/advisories/29560
• http://secunia.com/advisories/29607
• http://secunia.com/advisories/29616

Get alerted when CVE-2008-1238 or the next vulnerability affects your stack