CVE-2019-11747: Medium severity firefox esr vulnerability
Last updated 24 July 2024
Other sources
The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security (HSTS) settings received from sites that use it. Due to a bug, sites on the pre-load list also have their HSTS setting removed. On the next visit to that site if the user specifies an http: URL rather than secure https: they will not be protected by the pre-loaded HSTS setting. After that visit the site's HSTS setting will be restored.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-11747?
CVE-2019-11747 is a vulnerability in Mozilla Firefox that affects the 'Forget about this site' feature in the History pane.
How does CVE-2019-11747 impact users?
CVE-2019-11747 allows sites on the pre-load list to retain HTTP Strict Transport Security (HSTS) settings even after using the 'Forget about this site' feature, potentially compromising user privacy.
Which versions of Mozilla Firefox are affected by CVE-2019-11747?
Mozilla Firefox ESR versions up to 68.1, and Mozilla Firefox versions up to 69 are affected by CVE-2019-11747.
What is the severity of CVE-2019-11747?
CVE-2019-11747 has a low severity rating.
How can the vulnerability CVE-2019-11747 be fixed?
To fix CVE-2019-11747, users should update to Mozilla Firefox ESR 68.1 or newer, or Mozilla Firefox 69 or newer.