CVE-2017-7762

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
mozillaCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
VendorProductVersion
redhatenterprise_linux_desktop
6.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
6.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_workstation
6.0
redhatenterprise_linux_workstation
7.0
mozillafirefox
𝑥
< 54.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
zesty
Fixed 54.0+build3-0ubuntu0.17.04.1
released
yakkety
Fixed 54.0+build3-0ubuntu0.16.10.1
released
xenial
Fixed 54.0+build3-0ubuntu0.16.04.1
released
trusty
Fixed 54.0+build3-0ubuntu0.14.04.1
released
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/99047
http://www.securitytracker.com/id/1038689
https://access.redhat.com/errata/RHSA-2018:2112
https://access.redhat.com/errata/RHSA-2018:2113
https://bugzilla.mozilla.org/show_bug.cgi?id=1358248
https://www.mozilla.org/security/advisories/mfsa2017-15/
http://www.securityfocus.com/bid/99047
http://www.securitytracker.com/id/1038689
https://access.redhat.com/errata/RHSA-2018:2112
https://access.redhat.com/errata/RHSA-2018:2113
https://bugzilla.mozilla.org/show_bug.cgi?id=1358248
https://www.mozilla.org/security/advisories/mfsa2017-15/