CVE-2018-12402

Reference Links

• http://www.securityfocus.com/bid/105721
• https://bugzilla.mozilla.org/show_bug.cgi?id=1447087
• https://bugzilla.mozilla.org/show_bug.cgi?id=1469916
• https://www.mozilla.org/security/advisories/mfsa2018-26/
• http://www.securitytracker.com/id/1041944
• https://usn.ubuntu.com/3801-1/
• https://launchpad.net/bugs/cve/CVE-2018-12402
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12402
• https://security-tracker.debian.org/tracker/CVE-2018-12402
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12402
• https://nvd.nist.gov/vuln/detail/CVE-2018-12402
• https://ubuntu.com/security/CVE-2018-12402

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2018-26

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2018-12391
• CVE-2018-12392
• CVE-2018-12393
• CVE-2018-12395
• CVE-2018-12396
• CVE-2018-12397
• CVE-2018-12398
• CVE-2018-12402
• CVE-2018-12399
• CVE-2018-12400
• CVE-2018-12401
• CVE-2018-12403
• CVE-2018-12388
• CVE-2018-12390

Frequently Asked Questions

• What is CVE-2018-12402?

  CVE-2018-12402 is a vulnerability in Mozilla Firefox where the internal WebBrowserPersist code does not use the correct origin context for a resource being saved.

• How does CVE-2018-12402 manifest?

  CVE-2018-12402 manifests when sub-resources are loaded as part of the "Save Page As..." functionality.

• What can a malicious page do with CVE-2018-12402?

  A malicious page could recover a visitor's Windows username and NTLM hash by including resources.

• What is the severity of CVE-2018-12402?

  CVE-2018-12402 has a severity rating of medium (6.5).

• How can I fix CVE-2018-12402?

  To fix CVE-2018-12402, update to Mozilla Firefox version 63.0 or higher.

• Where can I find more information about CVE-2018-12402?

  You can find more information about CVE-2018-12402 on the Mozilla Security Advisories website.