CVE-2019-11723 Information disclosure in Firefox
Attackers can leak cookies from private browsing or container contexts during add-on installation, exposing sensitive session data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11723?
CVE-2019-11723 is a high-severity vulnerability in Mozilla Firefox, published on 23 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This vulnerability affects Firefox < 68.
Weakness: CWE-346
Which versions are affected by CVE-2019-11723?
It affects 2 products.
Products include Mozilla Firefox, Opensuse Leap.
How do I fix CVE-2019-11723?
Upgrade to a fixed version.
Is CVE-2019-11723 being exploited?
There is no known exploitation of CVE-2019-11723 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-2j5m-fjjv-cj2h, UBUNTU-CVE-2019-11723.