CVE-2019-17020

Katalog CVE

CVSS 6.5 · Medium EPSS 1,1%

Kerentanan Improper Restriction of XML External Entity Reference pada mozilla firefox, canonical ubuntu linux. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72.

Rincian

Terbit di NVD

8 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2020-01/ advisory vendor
• https://usn.ubuntu.com/4234-1/ advisory pihak ketiga
• https://bugzilla.mozilla.org/show_bug.cgi?id=1597645 permissions required