CVE-2019-11748 Security feature bypass in Firefox

What is CVE-2019-11748?

CVE-2019-11748 is a medium-severity vulnerability in Mozilla Firefox, published on 27 Sep 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile vulnerabilities in other software, a decision was made to no longer persist these permissions. This avoids the possibility of trusted WebRTC resources being invisibly embedded in web content and abusing permissions previously given by users. Users will now be prompted for permissions on each use. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

Weakness: CWE-281

Which versions are affected by CVE-2019-11748?

It affects 2 products.

Products include Mozilla Firefox, Mozilla Firefox Esr.

How do I fix CVE-2019-11748?

Upgrade to a fixed version.

Is CVE-2019-11748 being exploited?

There is no known exploitation of CVE-2019-11748 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Firefox

• CVE-2019-11708 Mozilla Firefox and Thunderbird Sandbox Escape Exploited Critical 10.0
• CVE-2010-3765 Mozilla Multiple Products Remote Code Execution Exploited Critical 9.8
• CVE-2022-26486 Mozilla Firefox Use-After-Free Exploited Critical 9.6
• CVE-2022-26485 Mozilla Firefox Use-After-Free Exploited High 8.8
• CVE-2019-11707 Mozilla Firefox and Thunderbird Type Confusion Exploited High 8.8

All Mozilla Firefox vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-11748, GHSA-pf67-g7x9-r27m, UBUNTU-CVE-2019-11748.