PT-2017-4034 · Mozilla+2 · Firefox+2
Eric Lawrence
·
Publicado
2017-09-25
·
Atualizado
2024-12-12
·
CVE-2017-7839
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 57
Description
The issue is related to the browser ignoring leading characters in javascript URLs pasted into the address bar, potentially allowing remote attackers to conduct cross-site scripting attacks. This could be exploited through social engineering tactics, convincing users to copy and paste malicious text into the address bar, leading to self-cross-site-scripting (self-XSS) attacks.
Recommendations
For versions prior to 57, update to version 57 or later to resolve the issue. As a temporary workaround, consider avoiding the copying and pasting of text into the address bar to minimize the risk of exploitation. Restrict access to potentially malicious websites and be cautious of social engineering attempts that may try to trick users into pasting harmful content into the address bar.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Ubuntu