CVE-2019-11761

MEDIUM5.4

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content

Published Jan 8, 2020

Modified 1 years ago

No fix available

Details

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

References

WEBhttps://bugzilla.mozilla.org/show_bug.cgi?id=1561502 ADVISORYhttps://security.gentoo.org/glsa/202003-10 ADVISORYhttps://usn.ubuntu.com/4335-1/ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2019-11761 WEBhttps://www.mozilla.org/security/advisories/mfsa2019-33/WEBhttps://www.mozilla.org/security/advisories/mfsa2019-34/WEBhttps://www.mozilla.org/security/advisories/mfsa2019-35/

CVSS Analysis

CVSS v3.1

5.4

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

5.4/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Ecosystems

Timeline

PublishedJan 8, 2020

ModifiedAug 4, 2024