Vulnerability Details : CVE-2019-11761
By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
Products affected by CVE-2019-11761
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-11761
0.23%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 61 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-11761
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST | |
|
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
2.8
|
2.5
|
NIST |
CWE ids for CVE-2019-11761
-
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.Assigned by: nvd@nist.gov (Primary)
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-11761
-
https://www.mozilla.org/security/advisories/mfsa2019-35/
Security vulnerabilities fixed in - Thunderbird 68.2 — MozillaVendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2019-34/
Security vulnerabilities fixed in - Firefox 70 — MozillaVendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1561502
Access DeniedIssue Tracking;Permissions Required
-
https://usn.ubuntu.com/4335-1/
USN-4335-1: Thunderbird vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2019-33/
Security vulnerabilities fixed in - Firefox ESR 68.2 — MozillaVendor Advisory
-
https://security.gentoo.org/glsa/202003-10
Mozilla Thunderbird: Multiple vulnerabilities (GLSA 202003-10) — Gentoo securityThird Party Advisory
Jump to