CVE-2019-11761 — Race Condition in Mozilla Firefox
Severity
5.4MEDIUMNVD
OSV8.8OSV7.5
EPSS
0.4%
top 36.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 8
Latest updateMay 24
Description
By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5
Affected Packages8 packages
Also affects: Ubuntu Linux 16.04
🔴Vulnerability Details
6GHSA▶
GHSA-44qm-5fqq-5hw7: By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content↗2022-05-24
OSV▶
CVE-2019-11761: By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content↗2020-01-08
CVEList▶
CVE-2019-11761: By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content↗2020-01-08