PT-2017-4022 · Mozilla+2 · Firefox+2
Jose María Acuña
·
Publicado
2017-05-31
·
Atualizado
2024-12-12
·
CVE-2017-7815
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 56
Description
The issue is related to the use of the "data:" protocol in Firefox, which can be exploited to create a modal dialog through JavaScript. This allows an attacker to spoof the origin of the modal dialog, making it appear as if it comes from an arbitrary domain. The attack is only successful on installations where e10 multiprocess is turned off, as those with e10s turned on do not support the modal dialog functionality.
Recommendations
For versions prior to 56, update to a version that contains a fix for this issue to prevent the spoofing of the modal dialog's origin. As a temporary workaround, consider disabling the use of modal dialogs in JavaScript until a patch is available.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Ubuntu