CVE-2018-12399 — Improper Authentication in Mozilla Firefox
Severity
4.3MEDIUMNVD
OSV8.8
EPSS
0.4%
top 38.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 28
Latest updateMay 14
Description
When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the new protocol. This may result in the user approving a protocol handler that they otherwise would not have. This vulnerability affects Firefox < 63.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages4 packages
Also affects: Ubuntu Linux 14.04, 16.04, 18.04, 18.10
🔴Vulnerability Details
4GHSA▶
GHSA-rw88-vh2c-q47r: When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the n↗2022-05-14
OSV▶
CVE-2018-12399: When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the n↗2018-10-24