PT-2019-4556 · Mozilla+3 · Firefox+3
Mark Banner
·
Publicado
2019-07-09
·
Atualizado
2024-12-12
·
CVE-2019-11718
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 68
Description
The issue is related to the implementation of the Activity Stream page in Firefox, where content is written without proper sanitization, potentially allowing a remote attacker to access confidential data. Specifically, the Activity Stream can display content from the Snippet Service website, which, if compromised, could lead to unauthorized access to other information available to the Activity Stream, such as browsing history.
Recommendations
For Firefox versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider restricting access to the Snippet Service or disabling the Activity Stream feature until a patch is applied. Avoid using the Activity Stream page with potentially compromised Snippet Service content to minimize the risk of exploitation.
Correção
Special Elements Injection
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Suse
Ubuntu