Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-xmc5-26p9-v4x6

Опубликовано: 14 мая 2022
Источник: github
Github: Не прошло ревью
CVSS3: 6.1

Описание

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.

EPSS

Процентиль: 62%
0.0043
Низкий

6.1 Medium

CVSS3

Дефекты

CWE-601

Связанные уязвимости

CVSS3: 6.1
ubuntu
около 7 лет назад

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.

CVSS3: 6.1
nvd
около 7 лет назад

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.

CVSS3: 6.1
debian
около 7 лет назад

WebExtensions could use the "mozAddonManager" API by modifying the CSP ...

suse-cvrf
больше 8 лет назад

Security update for MozillaFirefox

EPSS

Процентиль: 62%
0.0043
Низкий

6.1 Medium

CVSS3

Дефекты

CWE-601