CVE-2019-11737

MEDIUM

Description

If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. This vulnerability affects Firefox < 69.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1388015

https://www.mozilla.org/security/advisories/mfsa2019-25/

Details

Source: MITRE

Published: 2019-09-27

Updated: 2019-10-02

Type: CWE-345

Risk Information

CVSS v2.0

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3.0

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Impact Score: 1.4

Exploitability Score: 3.9

Severity: MEDIUM