CVE-2017-5420 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation8 documents5 sources
Severity
6.5MEDIUMNVD
OSV9.8
EPSS
0.4%
top 39.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedJun 11
Latest updateMay 14

Description

A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. This vulnerability affects Firefox < 52.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/firefox< firefox 52.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 52
▶NVDmozilla/firefox< 52.0
▶Ubuntumozilla/firefox< 52.0+build2-0ubuntu0.14.04.1+3

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-q432-46p9-q7g4: A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to↗2022-05-14
▶
OSV
firefox regression↗2017-03-30
▶
OSV
firefox vulnerabilities↗2017-03-07
▶
OSV
CVE-2017-5420: A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to↗2017-03-07
▶

📋Vendor Advisories

3
Ubuntu
Firefox regression↗2017-03-30
▶
Ubuntu
Firefox vulnerabilities↗2017-03-07
▶
Debian
CVE-2017-5420: firefox - A "javascript:" url loaded by a malicious page can obfuscate its location by bla...↗2017
▶