PT-2019-12484 · Mozilla+1 · Firefox+1

James Lee · Published 2019-06-11 · Updated 2020-08-24 · CVE-2019-11702

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 67.0.2

Description A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if a user approves execution when prompted. This issue only occurs on Windows, and other operating systems are unaffected.

Recommendations For versions prior to 67.0.2, update to Firefox 67.0.2 to resolve the issue. As a temporary workaround, consider avoiding the use of hyperlinks with the IE.HTTP: protocol until the update is applied. Restrict access to local files to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ALT-PU-2019-2098

CVE-2019-11702

Affected Products

Alt Linux

Firefox

References · 6

• https://bugzilla.mozilla.org/show_bug.cgi?id=1552627 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11702 · Security Note
• https://t.me/tmfeed/64690 · Telegram Post
• https://t.me/opennews/5233 · Telegram Post