PT-2018-3048 · Mozilla+3 · Firefox+3

Tadj Youssouf · Published 2018-05-09 · Updated 2024-12-12 · CVE-2018-5176

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 60

Description The JSON Viewer in Firefox has an issue where it displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. The vulnerability may also be exploited to perform cross-site scripting attacks.

Recommendations For versions prior to 60, update to version 60 or later to resolve the issue. As a temporary workaround, consider disabling the JSON Viewer feature until a patch is available. Restrict access to JSON files that may contain malicious "javascript:" links to minimize the risk of exploitation. Avoid clicking on suspicious links within the JSON Viewer to prevent potential code execution.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-1787

ALT-PU-2018-1854

BDU:2019-03516

CVE-2018-5176

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2019:2872-1

USN-3645-1

USN-3645-2

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 1932

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-11 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5176 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2872-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5182 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5176 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1442840 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03516 · Security Note
• https://usn.ubuntu.com/3645-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5160 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-5176 · Security Note
• https://ubuntu.com/security/CVE-2018-5154 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3645-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5159 · Vendor Advisory