PT-2019-5151 · Mozilla+2 · Firefox+2
Xiaoyin Liu
·
Publicado
2019-09-03
·
Atualizado
2024-12-12
·
CVE-2019-11737
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 69
Description
The issue is related to the Content Security Policy (CSP) directives in Firefox, where specifying a wildcard ('*') for the host causes any port or path restrictions to be ignored, leading to improper application of CSP directives to content. Additionally, there is an issue with insufficient data authentication, which could allow a remote attacker to compromise data integrity.
Recommendations
For versions prior to 69, update to version 69 or later to resolve the issue. As a temporary workaround, consider avoiding the use of wildcards in CSP directives for the host until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.
Correção
Insufficient Verification of Data Authenticity
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Ubuntu