peter bassill · operator
$ cve CVE-2019-11708 JSON

CVE-2019-11708 KEV EXPLOIT

10.0
CRITICAL · CVSS 3.1 · EPSS 55.9% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2022-06-13.

Description

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

Scoring

CVSS10.0 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS55.87% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-20
On CISA KEVyes — remediate by 2022-06-13
Public exploityes
Published2019-07-23
Last modified2026-06-17

CISA KEV

NameMozilla Firefox and Thunderbird Sandbox Escape Vulnerability
Added2022-05-23
Due2022-06-13
Vendor / productMozilla / Firefox and Thunderbird
Ransomware usenone reported

Affected (2)

VendorProduct
mozillafirefox
mozillathunderbird

Public exploits

SourceTitleDate
exploit-dbMozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack2019-12-07

References

→ the Explorer  ·  watch your stack  ·  NVD