5.3med
CVE-2017-7832
The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoo…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 74%
Public exploits
0
none known
Summary
The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoofed in the addressbar by the dotless version of 'i' followed by the same accent as a second character with most font sets. This allows for domain spoofing attacks because these combined domain names do not display as punycode. This vulnerability affects Firefox < 57.
Exploit prediction (EPSS)
1.48% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Affected products
- Mozilla Firefox
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- mozilla.org /security/advisories/mfsa2017-24/ · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/101832 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1039803 · vdb-entry, x_refsource_SECTRACK, x_transferred
- bugzilla.mozilla.org /show_bug.cgi?id=1408782 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-7832
- NVD: CVE-2017-7832
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.