PT-2018-3169 · Mozilla+5 · Firefox+5

Rob Wu

·

Publicado

2018-10-23

·

Atualizado

2024-12-12

·

CVE-2018-12397

CVSS v3.1

7.1

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 60.3 Firefox versions prior to 63
Description A WebExtension can request access to local files without displaying a warning prompt to the user, stating that the extension will "Access your data for all websites". This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. The issue is related to the lack of protection for service data in the WebExtensions system.
Recommendations For Firefox ESR versions prior to 60.3, update to version 60.3 or later. For Firefox versions prior to 63, update to version 63 or later.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2018-2550
ALT-PU-2018-2645
ALT-PU-2019-2324
ALT-PU-2019-2486
BDU:2019-04300
CESA-2018_3005
CESA-2018_3006
CVE-2018-12397
DLA-1571-1
DSA-4324-1
MGASA-2018-0420
OPENSUSE-SU-2018_3435-1
OPENSUSE-SU-2024:10600-1
OPENSUSE-SU-2024:14572-1
RHSA-2018:3005
RHSA-2018:3006
RHSA-2018_3005
RHSA-2018_3006
SUSE-SU-2018:3656-1
SUSE-SU-2018:3749-1
SUSE-SU-2018:3749-2
SUSE-SU-2018:3749-3
USN-3801-1
USN-3801-2

Produtos afetados

Alt Linux
Centos
Firefox
Red Hat
Suse
Ubuntu