CVE-2017-7788 — Injection in Mozilla Firefox

CWE-74 — InjectionCWE-863 — Incorrect Authorization12 documents7 sources
Severity
9.8CRITICALNVD
OSV9.1
EPSS
1.9%
top 16.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedJun 11
Latest updateMay 14

Description

When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy (CSP) as it should unless the sandbox attribute included "allow-same-origin". This vulnerability affects Firefox < 55.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/firefox< firefox 55.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 55
▶NVDmozilla/firefox< 55.0
▶Ubuntumozilla/firefox< 55.0.1+build2-0ubuntu0.14.04.2+3

🔴Vulnerability Details

5
GHSA
GHSA-rcj2-hjg7-xj8p: When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Se↗2022-05-14
▶
OSV
firefox regression↗2017-08-17
▶
OSV
ubufox update↗2017-08-16
▶
OSV
firefox vulnerabilities↗2017-08-15
▶
OSV
CVE-2017-7788: When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Se↗2017-08-10
▶

📋Vendor Advisories

5
Ubuntu
Firefox regression↗2017-08-17
▶
Ubuntu
Ubufox update↗2017-08-16
▶
Ubuntu
Firefox vulnerabilities↗2017-08-15
▶
Red Hat
Mozilla: Sandboxed about:srcdoc frames do not inherit CSP directives (MFSA 2017-18)↗2017-08-08
▶
Debian
CVE-2017-7788: firefox - When an "iframe" has a "sandbox" attribute and its content is specified using "s...↗2017
▶

💬Community

1
Bugzilla
CVE-2017-7788 Mozilla: Sandboxed about:srcdoc frames do not inherit CSP directives (MFSA 2017-18)↗2017-08-08
▶