CVE-2018-5131: Infoleak
Last updated 24 July 2024
Other sources
Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59.
— Launchpad
Under certain circumstances the fetch() API can return transient local copies of resources that were sent with a no-store or no-cache cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-07/#CVE-2018-5131
— Red Hat
Under certain circumstances the fetch() API can return transient local copies of resources that were sent with a no-store or no-cache cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing.
— Mozilla
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-5131?
CVE-2018-5131 is a vulnerability that allows the fetch() API to return transient local copies of resources that were sent with a 'no-store' or 'no-cache' cache header.
Which software is affected by CVE-2018-5131?
Mozilla Firefox versions up to 59, Mozilla Firefox ESR up to 52.7, Ubuntu Firefox versions up to 59.0, Ubuntu Firefox versions 59.0+ on Xenial and Artful, Ubuntu Firefox version 59.0.1+ on Bionic, Ubuntu Firefox version 59.0+ on Trusty, Debian Linux 7.0, 8.0, 9.0, Mozilla Firefox up to 59.0, Mozilla Firefox ESR up to 52.7.0, Redhat Enterprise Linux Desktop 6.0, 7.0, Redhat Enterprise Linux Server 6.0, 7.0, 7.4, 7.5, Redhat Enterprise Linux Workstation 6.0, 7.0, Canonical Ubuntu Linux 14.04, 16.04, 17.10, Debian Firefox version 119.0-1, Debian Firefox ESR versions 91.12.0esr-1~deb10u1, 115.4.0esr-1~deb10u1, 102.15.0esr-1~deb11u1, 115.4.0esr-1~deb11u1, 102.15.1esr-1~deb12u1, 115.4.0esr-1~deb12u1, 115.3.0esr-1, 115.4.0esr-1.
What is the severity of CVE-2018-5131?
CVE-2018-5131 has a severity of medium with a CVSS score of 5.9.
How can I fix CVE-2018-5131?
Update to a patched version of the affected software. Refer to the vendor's security advisory for specific instructions.
Where can I find more information about CVE-2018-5131?
You can find more information about CVE-2018-5131 in the following references: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1440775), [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2018-07/), [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/)