Permissions, Privileges, and Access Controls in Mozilla Firefox - CVE-2019-11737
Published: September 3, 2019
Vulnerability identifier: #VU20831
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-11737
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass CSP.
The vulnerability exists due to incorrect implementation of Content Security Policy (CSP) directive if a wildcard ('*') is specified for the host. A remote attacker can bypass CSP restrictions and gain unauthorized access to the application.
Impact from this issue depends on the web application architecture and may result in information disclosure.
Affected software
Mozilla Firefox
Arch Linux
firefox (Ubuntu package)
Arch Linux
firefox (Ubuntu package)
How to mitigate CVE-2019-11737
Install updates from vendor's website.
Mozilla Firefox - update to 69.0
firefox (Ubuntu package) - addressed in versions 69.0+build2-0ubuntu0.16.04.4, 69.0+build2-0ubuntu0.18.04.1, 69.0+build2-0ubuntu0.19.04.1, 69.0.2+build1-0ubuntu0.16.04.1, 69.0.2+build1-0ubuntu0.18.04.1, 69.0.2+build1-0ubuntu0.19.04.1
firefox (Ubuntu package) - addressed in versions 69.0+build2-0ubuntu0.16.04.4, 69.0+build2-0ubuntu0.18.04.1, 69.0+build2-0ubuntu0.19.04.1, 69.0.2+build1-0ubuntu0.16.04.1, 69.0.2+build1-0ubuntu0.18.04.1, 69.0.2+build1-0ubuntu0.19.04.1