Уязвимость получения доступа к информации через Activity Stream в Mozilla Firefox
Описание
Activity Stream отображает контент, полученный с веб-сайта Snippet Service. Этот контент записывается в innerHTML на странице Activity Stream без проверки, что позволяет получить доступ к другой информации, доступной Activity Stream, такой как история браузера, при компрометации Snippet Service.
Затронутые версии ПО
- Firefox версий до 68
Тип уязвимости
Компрометация данных
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Issue TrackingPermissions RequiredVendor Advisory
- Third Party Advisory
- Vendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Issue TrackingPermissions RequiredVendor Advisory
- Third Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
Связанные уязвимости
Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised. This vulnerability affects Firefox < 68.
Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised. This vulnerability affects Firefox < 68.
Activity Stream can display content from sent from the Snippet Service ...
Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised. This vulnerability affects Firefox < 68.
Уязвимость реализации страницы Activity Stream браузера Firefox, позволяющая нарушителю получить доступ к конфиденциальным данным
EPSS
5.3 Medium
CVSS3
5 Medium
CVSS2