Описание
The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display "javascript:" links, which users could be tricked into clicking by malicious sites. This vulnerability affects Firefox < 60.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | released | 60.0+build2-0ubuntu0.17.10.1 |
| bionic | released | 60.0+build2-0ubuntu1 |
| devel | released | 60.0+build2-0ubuntu1 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was released [60.0+build2-0ubuntu0.14.04.1]] |
| precise/esm | DNE | |
| trusty | released | 60.0+build2-0ubuntu0.14.04.1 |
| trusty/esm | DNE | trusty was released [60.0+build2-0ubuntu0.14.04.1] |
| upstream | released | 60.0 |
| xenial | released | 60.0+build2-0ubuntu0.16.04.1 |
Показывать по
EPSS
4.3 Medium
CVSS2
4.3 Medium
CVSS3
Связанные уязвимости
The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display "javascript:" links, which users could be tricked into clicking by malicious sites. This vulnerability affects Firefox < 60.
The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display "javascript:" links, which users could be tricked into clicking by malicious sites. This vulnerability affects Firefox < 60.
The web console and JavaScript debugger do not sanitize all output tha ...
The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display "javascript:" links, which users could be tricked into clicking by malicious sites. This vulnerability affects Firefox < 60.
Уязвимость веб-консоли и JavaScript-отладчика браузера Firefox ESR, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
4.3 Medium
CVSS2
4.3 Medium
CVSS3