Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2018-5152

Date: June 11, 2018

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts. This issue does not expose synchronization traffic directly and is limited to the process of user login to the website and the data displayed to the user once logged in. This vulnerability affects Firefox < 60.

Language: Unix

Severity Score

Related Resources (9)

https://nvd.nist.gov/vuln/detail/CVE-2018-5152
http://www.securitytracker.com/id/1040896
https://www.mozilla.org/security/advisories/mfsa2018-11/
https://usn.ubuntu.com/3645-1/
https://bugzilla.mozilla.org/show_bug.cgi?id=1415644
http://www.securityfocus.com/bid/104139
https://bugzilla.mozilla.org/show_bug.cgi?id=1427289
https://people.canonical.com/~ubuntu-security/cve/CVE-2018-5152
https://www.mend.io/vulnerability-database/CVE-2018-5152

Severity Score

Weakness Type (CWE)

Use of a Broken or Risky Cryptographic Algorithm

CWE-327

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us