Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

ubuntu логотип

CVE-2018-5176

Опубликовано: 11 июн. 2018
Источник: ubuntu
Приоритет: medium
CVSS2: 4.3
CVSS3: 6.1

Описание

The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60.

РелизСтатусПримечание
artful

released

60.0+build2-0ubuntu0.17.10.1
bionic

released

60.0+build2-0ubuntu1
devel

released

60.0+build2-0ubuntu1
esm-infra-legacy/trusty

DNE

trusty/esm was DNE [trusty was released [60.0+build2-0ubuntu0.14.04.1]]
precise/esm

DNE

trusty

released

60.0+build2-0ubuntu0.14.04.1
trusty/esm

DNE

trusty was released [60.0+build2-0ubuntu0.14.04.1]
upstream

released

60.0
xenial

released

60.0+build2-0ubuntu0.16.04.1

Показывать по

4.3 Medium

CVSS2

6.1 Medium

CVSS3

Связанные уязвимости

CVSS3: 6.1
redhat
около 7 лет назад

The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60.

CVSS3: 6.1
nvd
около 7 лет назад

The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60.

CVSS3: 6.1
debian
около 7 лет назад

The JSON Viewer displays clickable hyperlinks for strings that are par ...

CVSS3: 6.1
github
около 3 лет назад

The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60.

CVSS3: 6.1
fstec
больше 6 лет назад

Уязвимость средства просмотра JSON файлов JSON Viewer браузера Firefox, позволяющая нарушителю осуществлять межсайтовые сценарные атаки

4.3 Medium

CVSS2

6.1 Medium

CVSS3