What’s Vulnerable › Vulnerabilities

CVE-2019-11761

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-08 · updated 2026-06-17
• Weakness: CWE-362

Description

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

Affected products

• Canonical Ubuntu Linux: 16.04
• Mozilla Firefox: before 70.0 — fixed in 70.0
• Mozilla Firefox ESR: before 68.2 — fixed in 68.2
• Mozilla Thunderbird: before 68.2 — fixed in 68.2

How to fix

Upgrade to a fixed version: Mozilla Firefox 70.0; Mozilla Firefox ESR 68.2; Mozilla Thunderbird 68.2. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1561502
• https://security.gentoo.org/glsa/202003-10
• https://usn.ubuntu.com/4335-1/
• https://www.mozilla.org/security/advisories/mfsa2019-33/
• https://www.mozilla.org/security/advisories/mfsa2019-34/
• https://www.mozilla.org/security/advisories/mfsa2019-35/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1561502
• https://security.gentoo.org/glsa/202003-10
• https://usn.ubuntu.com/4335-1/
• https://www.mozilla.org/security/advisories/mfsa2019-33/
• https://www.mozilla.org/security/advisories/mfsa2019-34/
• https://www.mozilla.org/security/advisories/mfsa2019-35/

Get alerted when CVE-2019-11761 or the next vulnerability affects your stack