Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-5451

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Published

2018-06-11T21:29:06.607

Last Modified

2024-11-21T03:27:39.013

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-20

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	redhat	enterprise_linux	6.0	Yes
Operating System	redhat	enterprise_linux	7.0	Yes
Operating System	redhat	enterprise_linux_desktop	6.0	Yes
Operating System	redhat	enterprise_linux_desktop	7.0	Yes
Operating System	redhat	enterprise_linux_server	6.0	Yes
Operating System	redhat	enterprise_linux_server	7.0	Yes
Operating System	redhat	enterprise_linux_server_aus	7.3	Yes
Operating System	redhat	enterprise_linux_server_aus	7.4	Yes
Operating System	redhat	enterprise_linux_server_eus	7.3	Yes
Operating System	redhat	enterprise_linux_server_eus	7.4	Yes
Operating System	redhat	enterprise_linux_server_eus	7.5	Yes
Operating System	redhat	enterprise_linux_workstation	6.0	Yes
Operating System	redhat	enterprise_linux_workstation	7.0	Yes
Application	mozilla	firefox	< 53.0	Yes
Application	mozilla	firefox_esr	< 52.1.0	Yes
Application	mozilla	thunderbird	< 52.1.0	Yes

References

http://www.securityfocus.com/bid/97940 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1038320 Third Party Advisory, VDB Entry ([email protected])
https://access.redhat.com/errata/RHSA-2017:1106 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2017:1201 Third Party Advisory ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=1273537 Exploit, Issue Tracking, Patch, Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2017-10/ Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2017-12/ Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2017-13/ Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/97940 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1038320 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2017:1106 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2017:1201 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.mozilla.org/show_bug.cgi?id=1273537 Exploit, Issue Tracking, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2017-10/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2017-12/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2017-13/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)