Gregory Smiley

Weak authentication allows an authorized attacker to elevate privileges over a network, which enables them to affect the system.

An issue exists where the use of an uninitialized resource allows an authorized attacker to elevate privileges locally on the system.

The issue is related to NPAPI plugins, such as Flash, in Firefox and Thunderbird, where a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks, enabling remote attackers to perform actions on behalf of the user.