Уязвимость подмены URL в Mozilla Firefox при использовании JavaScript URL
Описание
При выполнении JavaScript URL (javascript:), если результатом является строка, она парсится для создания HTML-документа, который затем отображается. Ранее URL этого документа (например, в свойстве document.location) соответствовал начальной ссылке javascript:, что могло вести к атакам типа спуфинг. Сейчас URL корректно отражает адрес исходного документа.
Затронутые версии ПО
- Firefox версий ниже 74
Тип уязвимости
Спуфинг (подмена)
Ссылки
- Issue TrackingPermissions Required
- Vendor Advisory
- Issue TrackingPermissions Required
- Vendor Advisory
Уязвимые конфигурации
EPSS
6.5 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL (as reported by the document.location property, for example) was the originating javascript: URL which could lead to spoofing attacks; it is now correctly the URL of the originating document. This vulnerability affects Firefox < 74.
When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL (as reported by the document.location property, for example) was the originating javascript: URL which could lead to spoofing attacks; it is now correctly the URL of the originating document. This vulnerability affects Firefox < 74.
When a JavaScript URL (javascript:) is evaluated and the result is a s ...
When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL (as reported by the document.location property, for example) was the originating javascript: URL which could lead to spoofing attacks; it is now correctly the URL of the originating document. This vulnerability affects Firefox < 74.
EPSS
6.5 Medium
CVSS3
4.3 Medium
CVSS2