PT-2018-2998 · Mozilla+3 · Firefox+3
Francois Lajeunesse Robert
·
Publicado
2018-05-09
·
Atualizado
2024-12-12
·
CVE-2018-5166
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox ESR versions prior to 60
Firefox versions prior to 60
Description
The issue is related to errors in privilege assignment in the WebExtensions system for developing browser extensions. It allows a remote attacker to bypass existing security restrictions. WebExtensions can use request redirection and a "filterResponseData" filter to bypass host permission settings, redirect network traffic, and access content from a host without explicit user permission.
Recommendations
For Firefox ESR versions prior to 60, update to version 60 or later to resolve the issue.
For Firefox versions prior to 60, update to version 60 or later to resolve the issue.
As a temporary workaround, consider restricting the use of WebExtensions that utilize request redirection and the
filterResponseData filter until a patch is available.Correção
Improper Privilege Management
Incorrect Privilege Assignment
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Suse
Ubuntu