CVE-2019-17020 — XML External Entity (XXE) Injection in Mozilla Firefox
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 53.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 8
Latest updateMay 24
Description
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages5 packages
Also affects: Ubuntu Linux 16.04, 18.04, 19.04, 19.10
🔴Vulnerability Details
2GHSA▶
GHSA-p8vh-p3hc-xm35: If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied t↗2022-05-24
OSV▶
CVE-2019-17020: If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied t↗2020-01-08
📋Vendor Advisories
4Debian▶
CVE-2019-17020: firefox - If an XML file is served with a Content Security Policy and the XML file include...↗2019