Описание
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 64.0+build3-0ubuntu0.18.04.1 |
| cosmic | released | 64.0+build3-0ubuntu0.18.10.1 |
| devel | released | 64.0+build3-0ubuntu1 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was released [64.0+build3-0ubuntu0.14.04.1]] |
| precise/esm | DNE | |
| trusty | released | 64.0+build3-0ubuntu0.14.04.1 |
| trusty/esm | DNE | trusty was released [64.0+build3-0ubuntu0.14.04.1] |
| upstream | released | 64.0 |
| xenial | released | 64.0+build3-0ubuntu0.16.04.1 |
Показывать по
EPSS
4.3 Medium
CVSS2
6.5 Medium
CVSS3
Связанные уязвимости
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64.
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64.
Limitations on the URIs allowed to WebExtensions by the browser.window ...
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64.
Уязвимость компонента WebExtension браузера Firefox, связанная с некорректным ограничением URI, позволяющая нарушителю получить доступ к конфиденциальным данным
EPSS
4.3 Medium
CVSS2
6.5 Medium
CVSS3