CVE-2017-5384 — Sensitive Information Exposure in Mozilla Firefox

CWE-200 — Sensitive Information Exposure8 documents5 sources
Severity
5.9MEDIUMNVD
OSV9.8
EPSS
0.8%
top 26.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxDebian FirefoxDebian Firefox-esr
Timeline
PublishedJun 11
Latest updateMay 14

Description

Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than would be sent to the proxy itself in the case of HTTPS. Normally the Proxy Auto-Config file is specified by the user or machine owner and presumed to be non-malicious, but if a user has enabled Web Proxy Auto Detect (WPAD) this file can be served remotely. This vulnerability affects Firefox < 51.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages5 packages

▶debiandebian/firefox< firefox 51.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 51
▶NVDmozilla/firefox< 51.0
▶debiandebian/firefox-esr< firefox 51.0-1 (sid)
▶Ubuntumozilla/firefox< 51.0.1+build2-0ubuntu0.14.04.1+3

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-4f25-w4cj-3v45: Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than↗2022-05-14
▶
OSV
firefox regression↗2017-02-06
▶
OSV
firefox vulnerabilities↗2017-01-27
▶
OSV
CVE-2017-5384: Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than↗2017-01-25
▶

📋Vendor Advisories

3
Ubuntu
Firefox regression↗2017-02-06
▶
Ubuntu
Firefox vulnerabilities↗2017-01-27
▶
Debian
CVE-2017-5384: firefox - Proxy Auto-Config (PAC) files can specify a JavaScript function called for all U...↗2017
▶