CVE-2005-4874: Code Injection
The XMLHttpRequest object in Mozilla 1.7.8 supports the HTTP TRACE method, which allows remote attackers to obtain (1) proxy authentication passwords via a request with a "Max-Forwards: 0" header or (2) arbitrary local passwords on the web server that hosts this object.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-4874?
CVE-2005-4874 is considered to have a moderate severity level due to the potential for remote attackers to exploit sensitive information.
How do I fix CVE-2005-4874?
To fix CVE-2005-4874, upgrade to a newer version of Mozilla that does not support the HTTP TRACE method.
What systems are affected by CVE-2005-4874?
CVE-2005-4874 specifically affects Mozilla version 1.7.8.
What type of attack can CVE-2005-4874 facilitate?
CVE-2005-4874 can facilitate attacks that expose proxy authentication passwords and local passwords on the web server.
Are there any known exploits for CVE-2005-4874?
Yes, there are known exploits for CVE-2005-4874 that leverage the HTTP TRACE method to retrieve sensitive information.