CVE Vulnerability

CVE-2018-18506

When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. This vulnerability affects Firefox < 65.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.9 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.mozilla.org/security/advisories/mfsa2019-01/ Vendor Advisory
https://usn.ubuntu.com/3874-1/ Third Party Advisory
http://www.securityfocus.com/bid/106773 Third Party Advisory VDB Entry
https://www.debian.org/security/2019/dsa-4411 Third Party Advisory
https://seclists.org/bugtraq/2019/Mar/28 Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00024.html Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0623 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0622 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00035.html Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0681 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0680 Third Party Advisory
https://usn.ubuntu.com/3927-1/ Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00043.html Mailing List Third Party Advisory
https://www.debian.org/security/2019/dsa-4420 Third Party Advisory
https://seclists.org/bugtraq/2019/Apr/0 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/04/msg00000.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201904-07 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00023.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html
https://access.redhat.com/errata/RHSA-2019:0966
https://access.redhat.com/errata/RHSA-2019:1144
Configurations

Configuration 1

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Information

Published : 2019-02-05 09:29

Updated : 2020-08-24 05:37

NVD link : CVE-2018-18506

Mitre link : CVE-2018-18506

Products Affected

Enterprise Linux Workstation

Redhat

CWE
NVD-CWE-noinfo