PT-2017-4014 · Mozilla+2 · Firefox+2
Jun Kokatsu
·
Publicado
2017-05-24
·
Atualizado
2024-12-12
·
CVE-2017-7808
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 55
Description
The issue is related to the implementation of the Content Security Policy (CSP) mechanism in Mozilla Firefox, specifically with the "frame-ancestors" directive. This directive's weakness can be exploited by a remote attacker to gain unauthorized access to protected information, potentially leading to a cross-origin information leak of path information.
Recommendations
For versions prior to 55, update to version 55 or later to resolve the issue. As a temporary workaround, consider restricting the use of the "frame-ancestors" directive in Content Security Policy until a patch is applied.
Correção
Incorrect Authorization
Information Disclosure
Origin Validation Error
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Ubuntu