Vulnerability Details : CVE-2017-5415
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox < 52.
Vulnerability category: Input validation
Exploit prediction scoring system (EPSS) score for CVE-2017-5415
Probability of exploitation activity in the next 30 days: 2.54%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 89 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-5415
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2017-5415
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5415
-
https://www.mozilla.org/security/advisories/mfsa2017-05/
Security vulnerabilities fixed in Firefox 52 — MozillaVendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1321719
1321719 - (CVE-2017-5415) Address bar spoof using blob URI schemeExploit;Issue Tracking;Patch
-
http://www.securitytracker.com/id/1037966
Mozilla Firefox Multiple Bugs Let Remote Users Bypass Security Restrictions, Spoof URLs, Obtain Potentially Sensitive Information, Deny Service, and Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/96692
Mozilla Firefox MFSA 2017-05 Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
Products affected by CVE-2017-5415
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*