5.3med
CVE-2018-5142
If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not p…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
0
none known
Summary
If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for this permission. This vulnerability affects Firefox < 59.
Exploit prediction (EPSS)
1.19% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Affected products
- Mozilla Firefox
References
- securityfocus.com /bid/103386 · vdb-entry, x_refsource_BID, x_transferred
- bugzilla.mozilla.org /show_bug.cgi?id=1366357 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1040514 · vdb-entry, x_refsource_SECTRACK, x_transferred
- usn.ubuntu.com /3596-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
- mozilla.org /security/advisories/mfsa2018-06/ · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-5142
- NVD: CVE-2018-5142
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.