What’s Vulnerable › Vulnerabilities
CVE-2019-11744
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-09-27 · updated 2026-06-17
- Weakness: CWE-79
Description
Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
Affected products
- Mozilla Firefox: before 60.9; before 69.0; from 68.0 before 68.1 — fixed in 60.9, 68.1, 69.0
- Mozilla Thunderbird: before 60.9; from 68.0 before 68.1 — fixed in 60.9, 68.1
How to fix
Upgrade to a fixed version: Mozilla Firefox 60.9, 68.1, 69.0; Mozilla Thunderbird 60.9, 68.1. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1562033
- https://security.gentoo.org/glsa/201911-07
- https://usn.ubuntu.com/4150-1/
- https://www.mozilla.org/security/advisories/mfsa2019-25/
- https://www.mozilla.org/security/advisories/mfsa2019-26/
- https://www.mozilla.org/security/advisories/mfsa2019-27/
- https://www.mozilla.org/security/advisories/mfsa2019-29/
- https://www.mozilla.org/security/advisories/mfsa2019-30/
Get alerted when CVE-2019-11744 or the next vulnerability affects your stack