CVE-2017-7762 — Mozilla: address bar username and password spoofing in reader mode

Back Back to CVE browser

HIGH

Mozilla: address bar username and password spoofing in reader mode

Published Jun 11, 2018

7.5

HIGH

CVSS 3.0

EPSS 1.92%

Description

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <54

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<54

Red Hat Enterprise Linux 6

firefox-0:60.1.0-5.el6

Fixed · RHSA-2018:2112
Red Hat Enterprise Linux 7

firefox-0:60.1.0-4.el7_5

Fixed · RHSA-2018:2113
Red Hat Enterprise Linux 6

thunderbird

Not affected
Red Hat Enterprise Linux 7

thunderbird

Not affected
Red Hat Enterprise Linux 8

firefox

Not affected
Red Hat Enterprise Linux 8

thunderbird

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	firefox-0:60.1.0-5.el6	Fixed	RHSA-2018:2112
Red Hat Enterprise Linux 7	firefox-0:60.1.0-4.el7_5	Fixed	RHSA-2018:2113
Red Hat Enterprise Linux 6	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 7	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 8	firefox	Not affected	n/a
Red Hat Enterprise Linux 8	thunderbird	Not affected	n/a

Remediation

Red Hat statement

Red Hat Product Security has rated this issue as having a security impact of Moderate, and a future update may address this flaw.

Metrics

1.92% 0.01920

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01920

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.92% (0.01920)	79.16th	v5 (v2026.06.15)
Jun 15, 2026	1.94% (0.01945)	77.47th	v5 (v2026.06.15)
Mar 30, 2025	0.72% (0.00716)	70.05th	v4 (v2025.03.14)
Mar 29, 2025	2.14% (0.02144)	73.68th	v4 (v2025.03.14)
Mar 17, 2025	0.73% (0.00730)	70.98th	v4 (v2025.03.14)
Dec 12, 2024	0.23% (0.00233)	62.28th	v3 (v2023.03.01)
Nov 2, 2023	0.23% (0.00233)	61.31th	v3 (v2023.03.01)
Sep 3, 2023	0.25% (0.00248)	61.98th	v3 (v2023.03.01)
Mar 7, 2023	0.25% (0.00254)	61.53th	v3 (v2023.03.01)
Mar 6, 2023	1.11% (0.01108)	55.18th	v2 (v2022.01.01)
Feb 4, 2022	1.11% (0.01108)	29.61th	v2 (v2022.01.01)
Feb 3, 2022	1.45% (0.01454)	32.67th	v5 (v2026.06.15)
Apr 14, 2021	1.45% (0.01454)	0.00th	v1

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-290

Authentication Bypass by Spoofing

References (11)

http://www.securityfocus.com/bid/99047
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038689
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:2112
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2018:2113
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-7762
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1358248
x_refsource_CONFIRMExploitIssue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1590493
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-7762
https://www.cve.org/CVERecord?id=CVE-2017-7762
https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/
https://www.mozilla.org/security/advisories/mfsa2017-15/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/99047		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038689		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:2112		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2018:2113		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-7762		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1358248		x_refsource_CONFIRMExploitIssue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1590493		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-7762
https://www.cve.org/CVERecord?id=CVE-2017-7762
https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/
https://www.mozilla.org/security/advisories/mfsa2017-15/		x_refsource_CONFIRMVendor Advisory