CVE-2019-17001

Published: 23 October 2019

A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This is a separate bypass from CVE-2019-17000.*Note: This flaw only affected Firefox 69 and was not present in earlier versions.*. This vulnerability affects Firefox < 70.

Notes

mozjs contains a copy of the SpiderMonkey JavaScript engine

Priority

Medium

CVSS 3 base score: 6.1

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17001
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-17001
• https://ubuntu.com/security/notices/USN-4165-1
• NVD
• Launchpad
• Debian