CVE-2019-17022

MEDIUM

Description

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

References

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html

http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html

https://access.redhat.com/errata/RHSA-2020:0085

https://access.redhat.com/errata/RHSA-2020:0086

https://access.redhat.com/errata/RHSA-2020:0111

https://access.redhat.com/errata/RHSA-2020:0120

https://access.redhat.com/errata/RHSA-2020:0123

https://access.redhat.com/errata/RHSA-2020:0127

https://bugzilla.mozilla.org/show_bug.cgi?id=1602843

https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html

https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html

https://seclists.org/bugtraq/2020/Jan/12

https://seclists.org/bugtraq/2020/Jan/18

https://seclists.org/bugtraq/2020/Jan/26

https://usn.ubuntu.com/4234-1/

https://usn.ubuntu.com/4241-1/

https://www.debian.org/security/2020/dsa-4600

https://www.debian.org/security/2020/dsa-4603

https://www.mozilla.org/security/advisories/mfsa2020-01/

https://www.mozilla.org/security/advisories/mfsa2020-02/

Details

Source: MITRE

Published: 2020-01-08

Updated: 2020-01-13

Type: CWE-79

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Impact Score: 2.7

Exploitability Score: 2.8

Severity: MEDIUM