Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-11738

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mozilla

Description

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mozilla Firefox

  • unspecified to < 69affected

Mozilla Firefox ESR

  • unspecified to < 68.1affected

References