CVE-2011-2990

CVE-2011-2990 describes an information disclosure vulnerability in Mozilla Firefox 4.x through 5 and SeaMonkey 2.x before 2.3. The flaw lies in how Content Security Policy (CSP) violation reports handle proxy-authorization credentials, failing to remove them from listed request headers. This allows attackers to potentially obtain sensitive information by reading these reports, particularly when incorrect host resolution occurs with certain redirects. The vulnerability has a CVSS score of 5.0, indicating a medium severity. It is a network-based attack with low complexity, requiring no authentication, and primarily impacts confidentiality (C:P) without affecting integrity or availability. There is no evidence of active exploitation, nor are there any known Metasploit modules, Nuclei templates, or ExploitDB entries. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.