VulnerabilityModified
CVE-2019-11720
This allows malicious code to then be processed, evading cross-site scripting (XSS) filtering.
MEDIUM 6.1EPSS 1.08%
Does this matter?
Lower severity and a low EPSS score (1.08%). Track it; it rarely justifies an emergency change on its own.
Description
Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-site scripting (XSS) filtering. This vulnerability affects Firefox < 68.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.08% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mozilla/firefox · opensuse/leap
- Source
- security@mozilla.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1556230Issue Tracking, Permissions Required, Vendor Advisory
- https://security.gentoo.org/glsa/201908-12Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1556230Issue Tracking, Permissions Required, Vendor Advisory
- https://security.gentoo.org/glsa/201908-12Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.