PT-2017-4027 · Mozilla+2 · Firefox+2
Ben Kelly
·
Publicado
2017-09-22
·
Atualizado
2024-12-12
·
CVE-2017-7835
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 57
Description
The issue is related to mixed content blocking in Firefox, where insecure HTTP sub-resources in a secure HTTPS document were not correctly blocked, especially for resources that redirect from HTTPS to HTTP. This allowed content, such as scripts, to be loaded on a page when it should have been blocked. The vulnerability can be exploited to conduct cross-site scripting attacks.
Recommendations
For versions prior to 57, update to version 57 or later to resolve the issue. As a temporary workaround, consider restricting access to HTTP resources within HTTPS documents to minimize the risk of exploitation.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Ubuntu