Mozilla Firefox/Firefox ESR/Thunderbird URI privileges management

Summaryinfo

A vulnerability labeled as critical has been found in Mozilla Firefox, Firefox ESR and Thunderbird. Affected by this issue is some unknown functionality of the component URI Handler. Such manipulation leads to privileges management. This vulnerability is traded as CVE-2019-11761. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Mozilla Firefox, Firefox ESR and Thunderbird (Web Browser) (the affected version unknown) and classified as critical. Affected by this issue is an unknown part of the component URI Handler. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

The weakness was shared 01/08/2020 as Bug 1561502 as not defined bug report (Bugzilla). The advisory is shared for download at bugzilla.mozilla.org. This vulnerability is handled as CVE-2019-11761 since 05/03/2019. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/09/2020). The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading eliminates this vulnerability.

The entries VDB-148427, VDB-148426, VDB-148425 and VDB-148423 are related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox
• Firefox ESR
• Thunderbird

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion