CVE-2019-11761

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

Published: Jan 8, 2020
Updated: Apr 13, 2023
CVE: CVE-2019-11761
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CVSS v2:

Severity: Medium
Score: 5.8
AV:N/AC:M/Au:N/C:P/I:P/A:N

CWEs:

CWE-362
CWE-862

Affected Software
References

Software	From	Fixed in
mozilla / firefox_esr	-	68.2
mozilla / thunderbird	-	68.2
mozilla / firefox	-	70.0
canonical / ubuntu_linux	16.04	16.04.x

https://bugzilla.mozilla.org/show_bug.cgi?id=1561502
https://security.gentoo.org/glsa/202003-10
https://usn.ubuntu.com/4335-1/
https://www.mozilla.org/security/advisories/mfsa2019-33/
https://www.mozilla.org/security/advisories/mfsa2019-34/
https://www.mozilla.org/security/advisories/mfsa2019-35/

Vulnerability Database

CVE-2019-11761