In Firefox prior to 69.0, if a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
mozilla firefox esr |
||
mozilla firefox |
||
opensuse leap 15.0 |
||
opensuse leap 15.1 |