Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-18495

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64.

Published

2019-02-28T18:29:01.680

Last Modified

2024-11-21T03:56:02.767

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-732

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	firefox	< 64.0	Yes
Operating System	canonical	ubuntu_linux	14.04	Yes
Operating System	canonical	ubuntu_linux	16.04	Yes
Operating System	canonical	ubuntu_linux	18.04	Yes
Operating System	canonical	ubuntu_linux	18.10	Yes

References

http://www.securityfocus.com/bid/106167 Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 Issue Tracking, Permissions Required, Vendor Advisory ([email protected])
https://usn.ubuntu.com/3844-1/ Third Party Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2018-29/ Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/106167 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 Issue Tracking, Permissions Required, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/3844-1/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2018-29/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)