PT-2017-4034 · Mozilla+2 · Firefox+2
Eric Lawrence
·
Published
2017-09-25
·
Updated
2024-12-12
·
CVE-2017-7839
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 57
Description
The issue is related to the browser ignoring leading characters in javascript URLs pasted into the address bar, potentially allowing remote attackers to conduct cross-site scripting attacks. This could be exploited through social engineering tactics, convincing users to copy and paste malicious text into the address bar, leading to self-cross-site-scripting (self-XSS) attacks.
Recommendations
For versions prior to 57, update to version 57 or later to resolve the issue. As a temporary workaround, consider avoiding the copying and pasting of text into the address bar to minimize the risk of exploitation. Restrict access to potentially malicious websites and be cautious of social engineering attempts that may try to trick users into pasting harmful content into the address bar.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Ubuntu