Home > Vulnerability Database > CVE-2019-11711

Mend.io Vulnerability Database

CVE-2019-11711

Date: July 23, 2019

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Language: Unix

Severity Score

8.8

Related Resources (19)

Url: https://nvd.nist.gov/vuln/detail/CVE-2019-11711

Url: https://security.gentoo.org/glsa/201908-20

Url: https://www.mozilla.org/security/advisories/mfsa2019-21/

Url: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html

Url: https://security.alpinelinux.org/vuln/CVE-2019-11711

Url: https://www.mozilla.org/security/advisories/mfsa2019-23/

Url: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html

Url: https://www.mozilla.org/security/advisories/mfsa2019-22/

Url: https://security.gentoo.org/glsa/201908-12

Url: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=1552541

Url: https://lists.debian.org/debian-lts-announce/2019/08/msg00002.html

Url: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html

Url: https://security-tracker.debian.org/tracker/CVE-2019-11711

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11711

Url: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html

Url: https://access.redhat.com/security/cve/CVE-2019-11711

Url: https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html

Url: https://www.mend.io/vulnerability-database/CVE-2019-11711

Severity Score

8.8

Weakness Type (CWE)

Insufficient Information

NVD-CWE-noinfo

CVSS v3.1

Base Score:	8.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	6.8
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2019-11711

Date: July 23, 2019

Language: Unix

Severity Score

Related Resources (19)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?