VulnerabilityModified
CVE-2019-11723
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context.
HIGH 7.5EPSS 0.81%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This vulnerability affects Firefox < 68.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.81% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-346
- Affected
- mozilla/firefox · opensuse/leap
- Source
- security@mozilla.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1528335Issue Tracking, Permissions Required, Vendor Advisory
- https://security.gentoo.org/glsa/201908-12Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1528335Issue Tracking, Permissions Required, Vendor Advisory
- https://security.gentoo.org/glsa/201908-12Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.