CVE-2017-5382 : Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for th

Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox < 51.

Published 2018-06-11 21:29:03

Updated 2018-08-07 15:03:26

Source Mozilla Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2017-5382

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 60 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-5382

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2017-5382

https://www.mozilla.org/security/advisories/mfsa2017-01/

Security vulnerabilities fixed in Firefox 51 — Mozilla
Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1037693

Mozilla Firefox Multiple Bugs Let Remote Users Bypass Security Restrictions, Spoof URLs, Obtain Potentially Sensitive Information, and Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://bugzilla.mozilla.org/show_bug.cgi?id=1295322

1295322 - (CVE-2017-5382) In the newest nightly builds, its possible to capture chrome level exceptions at content level.
Issue Tracking;Patch
http://www.securityfocus.com/bid/95763

Mozilla Firefox Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url

Products affected by CVE-2017-5382

Mozilla » Firefox
Versions before (<) 51.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2017-5382

Exploit prediction scoring system (EPSS) score for CVE-2017-5382

CVSS scores for CVE-2017-5382

CWE ids for CVE-2017-5382

References for CVE-2017-5382

Products affected by CVE-2017-5382