7.4

CVE-2019-9803

EPSS 0.13%
Published 26.04.2019 17:29:03
Last modified 21.11.2024 04:52:20
Source security@mozilla.org
Teams watchlist Login
Open Login

The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some circumstances, allowing for potential man-in-the-middle attacks on the linked resources. This vulnerability affects Firefox < 66.

Affected products Warnungen 0 Metrics 3 CWE 1 References 7

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version < 66.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.13%	0.292

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.4	2.2	5.2	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov	5.8	8.6	4.9	AV:N/AC:M/Au:N/C:P/I:P/A:N

CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

https://www.mozilla.org/security/advisories/mfsa2019-07/

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=1437009

Vendor Advisory

Issue Tracking

https://bugzilla.mozilla.org/show_bug.cgi?id=1515863

Vendor Advisory

Issue Tracking

Permissions Required

https://w3c.github.io/webappsec-upgrade-insecure-requests/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-9803

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-9803

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-9803

EUVD