CVE-2019-11711: High severity thunderbird vulnerability
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-11711?
CVE-2019-11711 is a vulnerability that allows an attacker to inject script into arbitrary pages on different subdomains in Firefox and Thunderbird.
How does CVE-2019-11711 affect Mozilla Firefox and Firefox ESR?
CVE-2019-11711 affects Mozilla Firefox versions up to and excluding 68 and Firefox ESR versions up to and excluding 60.8.
How does CVE-2019-11711 affect Mozilla Thunderbird?
CVE-2019-11711 affects Mozilla Thunderbird versions up to and excluding 68.
How can an attacker exploit CVE-2019-11711?
An attacker can exploit CVE-2019-11711 by abusing the reuse of an inner window and using document.domain for cross-origin protections to inject script into arbitrary pages on different subdomains.
What is the severity of CVE-2019-11711?
CVE-2019-11711 has a severity rating of 8.8 (high) according to the Common Vulnerability Scoring System (CVSS).