CVE-2018-12382 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input ValidationCWE-451 — User Interface (UI) Misrepresentation of Critical Information5 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
0.4%
top 41.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedOct 18
Latest updateMay 14

Description

The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain name, scrolling the loaded domain out of view to the right. This can lead to user confusion. *This vulnerability only affects Firefox for Android < 62.*

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5mozilla/firefoxunspecified — 62
▶NVDmozilla/firefox62.0

🔴Vulnerability Details

1
GHSA
GHSA-5h49-hvr6-f7pm: The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded↗2022-05-14
▶

📋Vendor Advisories

2
Red Hat
Mozilla: Addressbar spoofing with javascript URI on Firefox for Android↗2018-09-05
▶
Debian
CVE-2018-12382: firefox - The displayed addressbar URL can be spoofed on Firefox for Android using a javas...↗2018
▶

💬Community

1
Bugzilla
CVE-2018-12382 Mozilla: Addressbar spoofing with javascript URI on Firefox for Android↗2018-09-05
▶