Search for vulnerabilities
Vulnerability details: VCID-wzyf-p8r7-aaah
Vulnerability ID VCID-wzyf-p8r7-aaah
Aliases CVE-2018-18494
Summary A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-346 Origin Validation Error
CWE-829 Inclusion of Functionality from Untrusted Control Sphere
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18494.html
rhas Critical https://access.redhat.com/errata/RHSA-2018:3831
rhas Critical https://access.redhat.com/errata/RHSA-2018:3833
rhas Important https://access.redhat.com/errata/RHSA-2019:0159
rhas Important https://access.redhat.com/errata/RHSA-2019:0160
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18494.json
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00424 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00424 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00424 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.00424 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01082 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
epss 0.01337 https://api.first.org/data/v1/epss?cve=CVE-2018-18494
rhbs high https://bugzilla.redhat.com/show_bug.cgi?id=1658401
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12405
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17466
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18492
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18493
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18494
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18498
cvssv3 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2018-18494
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2018-18494
archlinux Critical https://security.archlinux.org/AVG-833
generic_textual Low https://ubuntu.com/security/notices/USN-3844-1
generic_textual Low https://ubuntu.com/security/notices/USN-3868-1
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2018-29
generic_textual Medium https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/#CVE-2018-18494
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2018-30
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2018-31
generic_textual Medium https://www.mozilla.org/en-US/security/advisories/mfsa2018-31/#CVE-2018-18494
generic_textual Medium https://www.mozilla.org/security/advisories/mfsa2018-29/
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18494.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18494.json
https://api.first.org/data/v1/epss?cve=CVE-2018-18494
https://bugzilla.mozilla.org/show_bug.cgi?id=1487964
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12405
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17466
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18492
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18493
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18494
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18498
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2018/12/msg00002.html
https://security.gentoo.org/glsa/201903-04
https://ubuntu.com/security/notices/USN-3844-1
https://ubuntu.com/security/notices/USN-3868-1
https://usn.ubuntu.com/3844-1/
https://usn.ubuntu.com/3868-1/
https://www.debian.org/security/2018/dsa-4354
https://www.debian.org/security/2019/dsa-4362
https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/#CVE-2018-18494
https://www.mozilla.org/en-US/security/advisories/mfsa2018-31/#CVE-2018-18494
https://www.mozilla.org/security/advisories/mfsa2018-29/
https://www.mozilla.org/security/advisories/mfsa2018-30/
https://www.mozilla.org/security/advisories/mfsa2018-31/
http://www.securityfocus.com/bid/106168
1658401 https://bugzilla.redhat.com/show_bug.cgi?id=1658401
ASA-201812-9 https://security.archlinux.org/ASA-201812-9
AVG-833 https://security.archlinux.org/AVG-833
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
CVE-2018-18494 https://nvd.nist.gov/vuln/detail/CVE-2018-18494
mfsa2018-29 https://www.mozilla.org/en-US/security/advisories/mfsa2018-29
mfsa2018-30 https://www.mozilla.org/en-US/security/advisories/mfsa2018-30
mfsa2018-31 https://www.mozilla.org/en-US/security/advisories/mfsa2018-31
RHSA-2018:3831 https://access.redhat.com/errata/RHSA-2018:3831
RHSA-2018:3833 https://access.redhat.com/errata/RHSA-2018:3833
RHSA-2019:0159 https://access.redhat.com/errata/RHSA-2019:0159
RHSA-2019:0160 https://access.redhat.com/errata/RHSA-2019:0160
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-18494.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-18494
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-18494
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.56460
EPSS Score 0.00185
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.