Mozilla · Firefox · CVE-2012-4205
**Name of the Vulnerable Software and Affected Versions**
Mozilla Firefox versions prior to 17.0
Thunderbird versions prior to 17.0
SeaMonkey versions prior to 2.14
**Description**
The issue allows remote attackers to conduct cross-site request forgery (CSRF) attacks or obtain sensitive information by leveraging a sandboxed add-on. This is due to the assignment of the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes.
**Recommendations**
For Mozilla Firefox versions prior to 17.0, update to version 17.0 or later.
For Thunderbird versions prior to 17.0, update to version 17.0 or later.
For SeaMonkey versions prior to 2.14, update to version 2.14 or later.