CVE-2018-5143 - URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute

Back Back to CVE browser

MEDIUM

URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute

Published Jun 11, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 0.94%

Description

URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Firefox < 59.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <59

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<59

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

http://www.securityfocus.com/bid/103386
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040514
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1422643
x_refsource_CONFIRMIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-16929
Advisory
https://usn.ubuntu.com/3596-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-06/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/103386		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040514		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1422643		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-16929		Advisory
https://usn.ubuntu.com/3596-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-06/		x_refsource_CONFIRMVendor Advisory