CVE-2017-7762

MEDIUM

Description

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.

References

http://www.securityfocus.com/bid/99047

http://www.securitytracker.com/id/1038689

https://access.redhat.com/errata/RHSA-2018:2112

https://access.redhat.com/errata/RHSA-2018:2113

https://bugzilla.mozilla.org/show_bug.cgi?id=1358248

https://www.mozilla.org/security/advisories/mfsa2017-15/

Details

Source: MITRE

Published: 2018-06-11

Updated: 2018-07-30

Type: CWE-20

Risk Information

CVSS v2.0

Base Score: 5

Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3.0

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH