CVE-2019-11718: Medium severity firefox vulnerability
Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-11718.
What software is affected by this vulnerability?
The affected software includes Mozilla Firefox version up to and excluding 68, and openSUSE Leap versions 15.0 and 15.1.
What is the severity of CVE-2019-11718?
The severity of CVE-2019-11718 is medium with a CVSS score of 5.3.
How can the vulnerability be exploited?
The vulnerability can be exploited by displaying content from the Snippet Service website without sanitization, potentially granting access to other information on the Activity Stream page.
Are there any remediation steps available?
Yes, applying the available updates, specifically version 68 for Mozilla Firefox, can help mitigate the vulnerability.