CVE-2018-12370: CSRF
Published Jun 26, 2018
·Updated
In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited if loaded by a malicious site while Reader mode is active, bypassing CSRF protections.
Affected Software
7 affected componentsFixes available
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=17.10
Canonical Ubuntu Linux=18.04
Mozilla Firefox<61.0
Mozilla Firefox<61
61
debian/firefox
147.0.4-1
Remediation
Patch Available
Event History
Jun 26, 2018
CVE Published
12:00 AM
Oct 18, 2018
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionWeakness
Jan 11, 2024
Data Sourced
via Launchpad·10:48 PM
Description
Nov 25, 2025
Data Sourced
via Ubuntu·06:14 PM
RemedyDescriptionSeverityAffected Software
Feb 20, 2026
Data Sourced
via Debian·04:28 PM
DescriptionAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2018-12370?
CVE-2018-12370 has been classified as a high severity vulnerability.
2
How do I fix CVE-2018-12370?
To fix CVE-2018-12370, update Firefox to version 61.0 or higher, or upgrade your affected Ubuntu version to a patched release.
3
Which versions of Firefox are affected by CVE-2018-12370?
Firefox versions prior to 61.0 are affected by CVE-2018-12370.
4
Which Ubuntu versions are vulnerable to CVE-2018-12370?
Ubuntu versions 14.04, 16.04, 17.10, and 18.04 are vulnerable to CVE-2018-12370.
5
What type of attack does CVE-2018-12370 enable?
CVE-2018-12370 enables a cross-site request forgery (CSRF) attack when exiting Reader View.