PT-2019-5155 · Mozilla+5 · Firefox+5
Thomas Henlich
·
Publicado
2019-09-03
·
Atualizado
2024-12-12
·
CVE-2019-11747
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:M/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 69
Firefox ESR versions prior to 68.1
Description
The issue is related to the "Forget about this site" feature in the History pane, which is intended to remove all saved user data indicating a site visit, including HTTP Strict Transport Security (HSTS) settings. However, due to a bug, sites on the pre-load list also have their HSTS setting removed. This means that if a user visits such a site using an http: URL instead of a secure https: URL, they will not be protected by the pre-loaded HSTS setting until the site's HSTS setting is restored after the visit.
Recommendations
For Firefox versions prior to 69, update to version 69 or later to resolve the issue.
For Firefox ESR versions prior to 68.1, update to version 68.1 or later to resolve the issue.
Correção
Improper Initialization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Firefox
Red Hat
Suse
Ubuntu