What is CVE-2019-9804?

CVE-2019-9804 is a critical-severity vulnerability in Apple Mac OS X, classified under OS Command Injection. CVSS score: 9.8/10. Published 2019-04-26.

How severe is CVE-2019-9804?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Apple Mac OS X

CVE-2019-9804

In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash on macOS. *Note: This issue only affects macOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 66.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.018 (76.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apple Mac_os_x
Mozilla Firefox — versions unspecified

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security@mozilla.org (x_refsource_MISC, Vendor Advisory)
security@mozilla.org (x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2019-9804?: CVE-2019-9804 is a critical-severity vulnerability in Apple Mac OS X, classified under OS Command Injection. CVSS score: 9.8/10. Published 2019-04-26.
How severe is CVE-2019-9804?: Critical severity. CVSS v3 base score is 9.8 out of 10.