Vulnerability Description
A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 60.3.0 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Server Eus | 7.5 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 14.04 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/105718Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041944Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:3005Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3006Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1487478Issue TrackingPermissions RequiredVendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00008.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/201811-04Third Party Advisory
- https://usn.ubuntu.com/3801-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4324Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-27/Vendor Advisory
- http://www.securityfocus.com/bid/105718Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041944Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:3005Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3006Third Party Advisory
FAQ
What is CVE-2018-12397?
CVE-2018-12397 is a vulnerability with a CVSS score of 7.1 (HIGH). A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to r...
How severe is CVE-2018-12397?
CVE-2018-12397 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-12397?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Eus, Redhat Enterprise Linux Workstation.