5.9med
CVE-2016-5288
Web content could access information in the HTTP cache if e10s is disabled.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 78%
Public exploits
0
none known
Summary
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2.
Exploit prediction (EPSS)
1.74% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Affected products
- Mozilla Firefox
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- bugzilla.mozilla.org /show_bug.cgi?id=1310183 · x_refsource_CONFIRM, x_transferred
- mozilla.org /security/advisories/mfsa2016-87/ · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/93810 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1037077 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2016-5288
- NVD: CVE-2016-5288
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.