VULNERABILITY INTELLIGENCE
CVE-2019-11717
CVSS score5.3 MEDIUM
EPSS probability2.13%
CISA KEVNot currently listed
Published2019-07-23
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Weakness classification
- CWE-116: Improper Encoding or Escaping of Output
Primary references
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Exploit, Issue Tracking, Vendor Advisory
- security@mozilla.org — Mailing List, Third Party Advisory
- security@mozilla.org — Mailing List, Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Vendor Advisory
- security@mozilla.org — Vendor Advisory