Vulnerability Details : CVE-2019-11730
Potential exploit
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Products affected by CVE-2019-11730
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-11730
9.59%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-11730
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
References for CVE-2019-11730
-
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
[security-announce] openSUSE-SU-2019:2248-1: important: Security updateMailing List;Third Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2019-21/
Security vulnerabilities fixed in Firefox 68 — MozillaVendor Advisory
-
https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html
[SECURITY] [DLA 1869-1] firefox-esr security updateMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
[security-announce] openSUSE-SU-2019:1990-1: moderate: Security update fMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2019/08/msg00002.html
[SECURITY] [DLA 1870-1] thunderbird security updateMailing List;Third Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2019-22/
Security vulnerabilities fixed in Firefox ESR 60.8 — MozillaVendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
[security-announce] openSUSE-SU-2019:2249-1: important: Security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/201908-12
Mozilla Firefox: Multiple vulnerabilities (GLSA 201908-12) — Gentoo securityThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html
[security-announce] openSUSE-SU-2019:1813-1: important: Security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/201908-20
Mozilla Thunderbird: Multiple vulnerabilities (GLSA 201908-20) — Gentoo securityThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html
[security-announce] openSUSE-SU-2019:1811-1: important: Security updateMailing List;Third Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1558299
Access DeniedIssue Tracking;Permissions Required
-
https://www.mozilla.org/security/advisories/mfsa2019-23/
Security vulnerabilities fixed in Thunderbird 60.8 — MozillaVendor Advisory
Jump to