Home

CVE-2019-11730

Description

A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that apps predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Risk Information

Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
19.71

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities fixed in Mozilla Thunderbird (x64) (68.4.2)Windows
Multiple vulnerabilities fixed in Mozilla Thunderbird (68.4.2)Windows
Multiple Vulnerabilities are affected in Mozilla Firefox 67.0.4Windows
Multiple vulnerabilities are fixed in Update for Mozilla Firefox For Mac (68.0.1)Mac
Multiple vulnerabilities are fixed in Update for Mozilla Firefox For Mac (68.0.2)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (68.9.0)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (68.10.0)Mac
Multiple vulnerabilities are fixed in Update for Mozilla Thunderbird For Mac (60.8.0)Mac
Multiple vulnerabilities are fixed in Update for Mozilla Thunderbird For Mac (68.2.2)Mac
Multiple vulnerabilities are fixed in Update for Mozilla Thunderbird For Mac (68.3.0)Mac
Multiple vulnerabilities are fixed in Update for Mozilla Thunderbird For Mac (68.3.1)Mac
Multiple vulnerabilities are fixed in Update for Mozilla Thunderbird For Mac (68.4.1)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (68.4.2)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (68.5.0)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (68.6.0)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (68.7.0)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (68.8.0)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (68.8.1)Mac
Multiple Vulnerabilities are affected in Firefox ESR for Mac 60.7.2Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 60.7.2Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 67.0.4Mac
Multiple Vulnerabilities are affected in Mozilla Thunderbird for Mac 60.7.2Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac 60.8Mac
Mozilla Open Source mail and newsgroup client (USN-4064-1) thunderbird_60.8.0+build1-0ubuntu0.16.04.2_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4064-1) thunderbird_60.8.0+build1-0ubuntu0.16.04.2_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4064-1) thunderbird_60.8.0+build1-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4064-1) thunderbird_60.8.0+build1-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4064-1) thunderbird_60.8.0+build1-0ubuntu0.18.10.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4064-1) thunderbird_60.8.0+build1-0ubuntu0.18.10.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4064-1) thunderbird_60.8.0+build1-0ubuntu0.19.04.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4064-1) thunderbird_60.8.0+build1-0ubuntu0.19.04.1_amd64.debLinux
thunderbird security update(DSA-4482-1) thunderbird_60.8.0-1~deb9u1_i386.debLinux
thunderbird security update(DSA-4482-1) thunderbird_60.8.0-1~deb9u1_amd64.debLinux
thunderbird security update(DSA-4482-1) thunderbird_60.8.0-1~deb10u1_amd64.debLinux
SUSE-SU-2019:2620-1(SUSE Linux Enterprise Desktop 12-SP4 ) MozillaFirefox-68.1.0-109.89.1.x86_64.rpmLinux
SUSE-SU-2019:2620-1(SUSE Linux Enterprise Desktop 12-SP4 ) MozillaFirefox-branding-SLE-68-32.8.1.x86_64.rpmLinux
SUSE-SU-2019:2620-1(SUSE Linux Enterprise Desktop 12-SP4 ) MozillaFirefox-debuginfo-68.1.0-109.89.1.x86_64.rpmLinux
SUSE-SU-2019:2620-1(SUSE Linux Enterprise Desktop 12-SP4 ) MozillaFirefox-debugsource-68.1.0-109.89.1.x86_64.rpmLinux
SUSE-SU-2019:2620-1(SUSE Linux Enterprise Desktop 12-SP4 ) MozillaFirefox-translations-common-68.1.0-109.89.1.x86_64.rpmLinux

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-312673Mozilla Thunderbird (x64) (68.4.2)
PATCH-312668Mozilla Thunderbird (68.4.2)
PATCH-343015Mozilla Firefox (132.0.2)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-612783Mozilla Firefox For Mac (145.0.1)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234