Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-xmc5-26p9-v4x6

Опубликовано: 14 мая 2022
Источник: github
Github: Не прошло ревью
CVSS3: 6.1

Описание

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.

EPSS

Процентиль: 59%
0.00374
Низкий

6.1 Medium

CVSS3

Дефекты

CWE-601

Связанные уязвимости

CVSS3: 6.1
ubuntu
больше 7 лет назад

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.

CVSS3: 6.1
nvd
больше 7 лет назад

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.

CVSS3: 6.1
debian
больше 7 лет назад

WebExtensions could use the "mozAddonManager" API by modifying the CSP ...

suse-cvrf
около 9 лет назад

Security update for MozillaFirefox

EPSS

Процентиль: 59%
0.00374
Низкий

6.1 Medium

CVSS3

Дефекты

CWE-601