Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

debian логотип

CVE-2017-7823

Опубликовано: 11 июн. 2018
Источник: debian
EPSS Низкий

Описание

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

Пакеты

ПакетСтатусВерсия исправленияРелизТип
firefoxfixed56.0-1package
firefox-esrfixed52.4.0esr-2package
thunderbirdfixed1:52.4.0-1package

Примечания

  • https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7823

  • https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/#CVE-2017-7823

  • https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7823

EPSS

Процентиль: 80%
0.01416
Низкий

Связанные уязвимости

CVSS3: 5.4
ubuntu
около 7 лет назад

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

CVSS3: 6.1
redhat
почти 8 лет назад

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

CVSS3: 5.4
nvd
около 7 лет назад

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

CVSS3: 5.4
github
около 3 лет назад

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

CVSS3: 7.5
fstec
почти 8 лет назад

Уязвимость реализации механизма CSP браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю осуществлять межсайтовые сценарные атаки

EPSS

Процентиль: 80%
0.01416
Низкий