CVEvulnerability
CVE-2018-18495
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-02-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-732
Description
WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64.
Affected configurations
• mozilla firefox (< 64.0)
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
Related
Weakness · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
References
- http://www.securityfocus.com/bid/106167 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 Issue Tracking, Permissions Required, Vendor Advisory
- https://usn.ubuntu.com/3844-1/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-29/ Vendor Advisory
- http://www.securityfocus.com/bid/106167 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 Issue Tracking, Permissions Required, Vendor Advisory
- https://usn.ubuntu.com/3844-1/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-29/ Vendor Advisory