CVE-2017-5417 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation8 documents5 sources
Severity
5.3MEDIUMNVD
OSV9.8
EPSS
0.4%
top 41.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedJun 11
Latest updateMay 14

Description

When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly loaded page. This allows for spoofing attacks. This vulnerability affects Firefox < 52.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/firefox< firefox 52.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 52
▶NVDmozilla/firefox< 52.0
▶Ubuntumozilla/firefox< 52.0+build2-0ubuntu0.14.04.1+3

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-vc4r-c5fj-5mmm: When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the display↗2022-05-14
▶
OSV
firefox regression↗2017-03-30
▶
OSV
firefox vulnerabilities↗2017-03-07
▶
OSV
CVE-2017-5417: When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the display↗2017-03-07
▶

📋Vendor Advisories

3
Ubuntu
Firefox regression↗2017-03-30
▶
Ubuntu
Firefox vulnerabilities↗2017-03-07
▶
Debian
CVE-2017-5417: firefox - When dragging content from the primary browser pane to the addressbar on a malic...↗2017
▶