CVE-2018-5176
N/A
N/A
Summary
The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mozilla | Firefox | unspecified < 60 | affected |
Weaknesses
- JSON Viewer script injection
ADP Enrichment
CVE Program Container
Additional References
- https://www.mozilla.org/security/advisories/mfsa2018-11/
- http://www.securitytracker.com/id/1040896
- https://usn.ubuntu.com/3645-1/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1442840
- http://www.securityfocus.com/bid/104139
References
- https://www.mozilla.org/security/advisories/mfsa2018-11/
- http://www.securitytracker.com/id/1040896
- https://usn.ubuntu.com/3645-1/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1442840
- http://www.securityfocus.com/bid/104139
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.