CVE-2017-7835

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resources that redirect from HTTPS to HTTP, allowing content that should be blocked, such as scripts, to be loaded on a page. This vulnerability affects Firefox < 57.

References

http://www.securityfocus.com/bid/101832

http://www.securitytracker.com/id/1039803

https://bugzilla.mozilla.org/show_bug.cgi?id=1402363

https://www.mozilla.org/security/advisories/mfsa2017-24/

Details

Source: MITRE

Published: 2018-06-11

Updated: 2019-10-03

Risk Information

CVSS v2

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3

Base Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Impact Score: 3.4

Exploitability Score: 3.9

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to 56.0.2 (inclusive)

Tenable Plugins

View all (11 total)

IDNameProductFamilySeverity
700322Mozilla Firefox < 57 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
critical
105542Ubuntu 14.04 LTS / 16.04 LTS / 17.04 / 17.10 : firefox regression (USN-3477-4)NessusUbuntu Local Security Checks
critical
104994Ubuntu 14.04 LTS / 16.04 LTS / 17.04 / 17.10 : firefox regressions (USN-3477-3)NessusUbuntu Local Security Checks
critical
104836FreeBSD : palemoon -- multiple vulnerabilities (6056bf68-f570-4e70-b740-b9f606971283)NessusFreeBSD Local Security Checks
high
104807Ubuntu 14.04 LTS / 16.04 LTS / 17.04 / 17.10 : firefox regression (USN-3477-2)NessusUbuntu Local Security Checks
critical
104652Ubuntu 14.04 LTS / 16.04 LTS / 17.04 / 17.10 : firefox vulnerabilities (USN-3477-1)NessusUbuntu Local Security Checks
critical
104638Mozilla Firefox < 57 Multiple VulnerabilitiesNessusWindows
critical
104637Mozilla Firefox ESR < 52.5 Multiple VulnerabilitiesNessusWindows
critical
104636Mozilla Firefox < 57 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
104635Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
104564FreeBSD : mozilla -- multiple vulnerabilities (f78eac48-c3d1-4666-8de5-63ceea25a578)NessusFreeBSD Local Security Checks
critical