Improper input validation in Mozilla Firefox
CVE-2017-7762
When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.019 (78.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Mozilla Firefox — versions unspecified
- Redhat Enterprise_linux_desktop — versions 6.0, 7.0
- Redhat Enterprise_linux_server — versions 6.0, 7.0
- Redhat Enterprise_linux_workstation — versions 6.0, 7.0
Weakness classification (CWE)
References
- security@mozilla.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@mozilla.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security@mozilla.org (x_refsource_CONFIRM, Exploit, Patch, Issue Tracking)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2017-7762?
- CVE-2017-7762 is a high-severity vulnerability in Mozilla Firefox, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2018-06-11.
- How severe is CVE-2017-7762?
- High severity. CVSS v3 base score is 7.5 out of 10.