Improper input validation in Mozilla Firefox
CVE-2018-5176
The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.014 (70.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Mozilla Firefox — versions unspecified
- Canonical Ubuntu_linux — versions 14.04, 16.04, 17.10
Weakness classification (CWE)
References
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- security@mozilla.org (Vendor Advisory, Permissions Required, x_refsource_CONFIRM, Issue Tracking)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2018-5176?
- CVE-2018-5176 is a medium-severity vulnerability in Mozilla Firefox, classified under Improper Input Validation. CVSS score: 6.1/10. Published 2018-06-11.
- How severe is CVE-2018-5176?
- Medium severity. CVSS v3 base score is 6.1 out of 10.