CVE-2015-0812

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an…

published April 1, 2015

CVSS
—
EPSS
1%
Percentile
65.3
In the wild
Unconfirmed
What it is

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01096 · 65.3th percentile
Published
2015-04-01T10:00Z
EPSS history
Timeline
  • 01 APR 10:00Z
    Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an…
    cvelistv5