CVE-2017-7839 — Cross-site Scripting in Mozilla Firefox

CWE-79 — Cross-site Scripting12 documents5 sources
Severity
6.1MEDIUMNVD
OSV9.8
EPSS
0.6%
top 29.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedJun 11
Latest updateMay 14

Description

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶debiandebian/firefox< firefox 57.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 57
▶Ubuntumozilla/firefox< 57.0+build4-0ubuntu0.14.04.4+8
▶NVDmozilla/firefox56.0.2

🔴Vulnerability Details

6
GHSA
GHSA-42vq-2prv-qxmf: Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScri↗2022-05-14
▶
OSV
firefox regression↗2018-01-03
▶
OSV
firefox regressions↗2017-12-01
▶
OSV
firefox regression↗2017-11-27
▶
OSV
firefox vulnerabilities↗2017-11-16
▶

📋Vendor Advisories

5
Ubuntu
Firefox regression↗2018-01-03
▶
Ubuntu
Firefox regressions↗2017-12-01
▶
Ubuntu
Firefox regression↗2017-11-27
▶
Ubuntu
Firefox vulnerabilities↗2017-11-16
▶
Debian
CVE-2017-7839: firefox - Control characters prepended before "javascript:" URLs pasted in the addressbar ...↗2017
▶