{
  "cveId": "CVE-2018-12402",
  "url": "https://patchblox.com/security/cve/CVE-2018-12402",
  "summary": "CVE-2018-12402 is fixed in 4 products on 1 platform, first by firefox 63.0\u002Bbuild2-0ubuntu0.18.04.2, released October 23, 2018. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "firefox: The internal WebBrowserPersist code does not use correct origin context for a resource being saved",
  "description": "The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of \u0022Save Page As...\u0022 functionality. For example, a malicious page could recover a visitor\u0027s Windows username and NTLM hash by including resources otherwise unreachable to the malicious page, if they can convince the visitor to save the complete web page. Similarly, SameSite cookies are sent on cross-origin requests when the \u0022Save Page As...\u0022 menu item is selected to save a page, which can result in saving the wrong version of resources based on those cookies. This vulnerability affects Firefox \u0026lt; 63.",
  "published": "2018-10-23T17:00:00Z",
  "severity": "Low",
  "epss": 0.01519,
  "epssPercentile": 0.74732,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "63.0\u002Bbuild2-0ubuntu0.18.04.2",
      "fix": "firefox 63.0\u002Bbuild2-0ubuntu0.18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-63.0-build2-0ubuntu0.18.04.2",
      "released": "2018-10-23T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-globalmenu",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "63.0\u002Bbuild2-0ubuntu0.18.04.2",
      "fix": "firefox-globalmenu 63.0\u002Bbuild2-0ubuntu0.18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-globalmenu-63.0-build2-0ubuntu0.18.04.2",
      "released": "2018-10-23T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-mozsymbols",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "63.0\u002Bbuild2-0ubuntu0.18.04.2",
      "fix": "firefox-mozsymbols 63.0\u002Bbuild2-0ubuntu0.18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-mozsymbols-63.0-build2-0ubuntu0.18.04.2",
      "released": "2018-10-23T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-testsuite",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "63.0\u002Bbuild2-0ubuntu0.18.04.2",
      "fix": "firefox-testsuite 63.0\u002Bbuild2-0ubuntu0.18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-testsuite-63.0-build2-0ubuntu0.18.04.2",
      "released": "2018-10-23T17:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}