CVE-2019-11711

8.8 HIGH
Published: July 23, 2019 Modified: November 25, 2025
View on NVD

Description

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html
Source: security@mozilla.org
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html
Source: security@mozilla.org
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
Source: security@mozilla.org
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
Source: security@mozilla.org
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
Source: security@mozilla.org
Broken Link
https://bugzilla.mozilla.org/show_bug.cgi?id=1552541
Source: security@mozilla.org
Issue Tracking Permissions Required Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html
Source: security@mozilla.org
Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00002.html
Source: security@mozilla.org
Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201908-12
Source: security@mozilla.org
Third Party Advisory
https://security.gentoo.org/glsa/201908-20
Source: security@mozilla.org
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-21/
Source: security@mozilla.org
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-22/
Source: security@mozilla.org
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-23/
Source: security@mozilla.org
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
https://bugzilla.mozilla.org/show_bug.cgi?id=1552541
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking Permissions Required Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00002.html
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201908-12
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://security.gentoo.org/glsa/201908-20
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-21/
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-22/
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-23/
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

26 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.8 / 10.0
EPSS (Exploit Probability)
1.5%
80th percentile
Exploitation Status
Not in CISA KEV

Affected Vendors

mozilla debian