Published: 11/06/2018 Updated: 03/10/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts. This issue does not expose synchronization traffic directly and is limited to the process of user login to the website and the data displayed to the user once logged in. This vulnerability affects Firefox < 60.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox
canonical ubuntu linux 16.04
canonical ubuntu linux 18.04
canonical ubuntu linux 17.10
canonical ubuntu linux 14.04

USN-3645-1 caused a regression in Firefox ...

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accountsfirefoxcom and listen to network traffic to the site through the "webRequest" API For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts This issue does not expose synchronizati ...

Mozilla Foundation Security Advisory 2018-11 Security vulnerabilities fixed in Firefox 60 Announced May 9, 2018 Impact critical Products Firefox Fixed in Firefox 60 ...

An information disclosure vulnerability has been found in Firefox < 600 WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accountsfirefoxcom and listen to network traffic to the site through the webRequest API For example, this allows for the interception of username and an encrypted password ...

CWE-327 https://www.mozilla.org/security/advisories/mfsa2018-11/https://bugzilla.mozilla.org/show_bug.cgi?id=1427289 https://bugzilla.mozilla.org/show_bug.cgi?id=1415644 https://usn.ubuntu.com/3645-1/http://www.securitytracker.com/id/1040896 http://www.securityfocus.com/bid/104139 https://nvd.nist.gov https://usn.ubuntu.com/3645-2/

CVE-2018-5152

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect