Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-7839

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.

Published

2018-06-11T21:29:11.780

Last Modified

2024-11-21T03:32:46.537

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	firefox	≤ 56.0.2	Yes

References

http://www.securityfocus.com/bid/101832 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1039803 Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=1402896 Issue Tracking, Permissions Required ([email protected])
https://www.mozilla.org/security/advisories/mfsa2017-24/ Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/101832 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1039803 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.mozilla.org/show_bug.cgi?id=1402896 Issue Tracking, Permissions Required (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2017-24/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)