CVE-2018-12403 : If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not dis

If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. This vulnerability affects Firefox < 63.

Published 2019-02-28 18:29:01

Updated 2020-08-24 17:37:01

Source Mozilla Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2018-12403

EPSS FAQ

0.63%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 79 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-12403

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

References for CVE-2018-12403

https://usn.ubuntu.com/3801-1/

USN-3801-1: Firefox vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/105721

Mozilla Firefox Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
https://bugzilla.mozilla.org/show_bug.cgi?id=1484753

1484753 - (CVE-2018-12403) Firefox doesn't mark sites with http favicons as mixed content
Issue Tracking;Permissions Required;Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-26/

Security vulnerabilities fixed in Firefox 63 — Mozilla
Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1041944

Mozilla Firefox Multiple Bugs Let Remote Users Deny Service, Obtain Potentially Sensitive Information, and Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url

Products affected by CVE-2018-12403

Mozilla » Firefox
Versions before (<) 63.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.10
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2018-12403

Exploit prediction scoring system (EPSS) score for CVE-2018-12403

CVSS scores for CVE-2018-12403

References for CVE-2018-12403

Products affected by CVE-2018-12403