CVE-2019-11708

10.0

CVSS
Critical

PUBLISHED

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed...

Exploited in the wild Remote Low complexity No user interaction

Vendor: Mozilla
Product: Firefox ESR, Firefox, Thunderbird
Published: Jul 23, 2019
EPSS: —

Description

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

cisa

CVSS scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 10.0

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation status

Exploited in the wild

Recorded 2022-05-23 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: No
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	May 23, 2022

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

0vercl0k/CVE-2019-11708

github · Created 2019-09-29 07:08:52 UTC · 624 stars

Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit.

Vulnerability detail