Vulnerability Description
By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 70.0 |
| Mozilla | Firefox Esr | < 68.2 |
| Mozilla | Thunderbird | < 68.2 |
| Canonical | Ubuntu Linux | 16.04 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1561502Issue TrackingPermissions Required
- https://security.gentoo.org/glsa/202003-10Third Party Advisory
- https://usn.ubuntu.com/4335-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-33/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-34/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-35/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1561502Issue TrackingPermissions Required
- https://security.gentoo.org/glsa/202003-10Third Party Advisory
- https://usn.ubuntu.com/4335-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-33/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-34/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-35/Vendor Advisory
FAQ
What is CVE-2019-11761?
CVE-2019-11761 is a vulnerability with a CVSS score of 5.4 (MEDIUM). By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it w...
How severe is CVE-2019-11761?
CVE-2019-11761 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11761?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird, Canonical Ubuntu Linux.