Security readout for executives and security teams
Plain-English summary
This is an old browser-side information disclosure issue in Mozilla 1.7.8. Its XMLHttpRequest object allowed HTTP TRACE requests, which could expose proxy authentication passwords or local passwords tied to the hosting web server. The source bundle does not provide a CVSS score, confirmed patch, or active exploitation evidence.
Executive priority
Treat this as a legacy-technology hygiene issue unless Mozilla 1.7.8 is still present. Prioritize removal from managed environments over emergency response, because no active exploitation or modern product impact is shown.
Technical view
CVE-2005-4874 concerns Mozilla 1.7.8 XMLHttpRequest support for HTTP TRACE. The CVE description says remote attackers could obtain proxy authentication passwords using a Max-Forwards: 0 header, or obtain arbitrary local passwords on the server hosting the object. Affected scope beyond Mozilla 1.7.8 is not established in the bundle.
Likely exposure
Exposure appears limited to environments still using Mozilla 1.7.8 or systems preserving that legacy behavior. Modern supported browsers are not identified as affected in the supplied sources.
Exploitation context
The bundle does not report active exploitation, and KEV is false. The described risk depends on the affected browser behavior and HTTP TRACE being usable in a relevant proxy or hosting context.
Researcher notes
Evidence is sparse and historical. The CVE names Mozilla 1.7.8 and the TRACE behavior, but the bundle lacks CVSS, CWE, concrete patch details, and broader version ranges. Avoid expanding affected scope without primary vendor confirmation.
Mitigation direction
- Identify and remove Mozilla 1.7.8 from managed endpoints.
- Check Mozilla Bugzilla or vendor guidance for the historical fixed version.
- Use supported browsers with current security maintenance.
- Assess TRACE exposure as a compensating-control review, following server vendor guidance.
Validation and detection
- Inventory endpoints and legacy application bundles for Mozilla 1.7.8.
- Review proxy and web logs for unexpected HTTP TRACE activity.
- Confirm whether legacy clients use proxy authentication in affected environments.
- Review the cited Bugzilla records for fix status and deployment notes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2005-4874 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.mozilla.org/show_bug.cgi?id=297078CVE reference · x_refsource_CONFIRM
- mozilla-xmlhttprequest-info-disclosure(41553)CVE reference · vdb-entry, x_refsource_XF
- https://bugzilla.mozilla.org/show_bug.cgi?id=302489CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.