Mozilla Foundation Security Advisory 2010-63
Information leak via XMLHttpRequest statusText
- Announced
- September 7, 2010
- Reporter
- Matt Haggard, Nicholas Berthaume
- Impact
- Low
- Products
- Firefox, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 3.5.12
- Firefox 3.6.9
- SeaMonkey 2.0.7
- Thunderbird 3.0.7
- Thunderbird 3.1.3
Description
Matt Haggard reported that
the statusText property of an XMLHttpRequest
object is readable by the requestor even when the request is made
across origins. This status information reveals the presence of a web
server and could be used to gather information about servers on
internal private networks.
This issue was also independently reported to Mozilla by Nicholas Berthaume