| Vulnerability Name: | CVE-2019-11696 (CCN-161351) | ||||||||||||||||||||||||||||
| Assigned: | 2019-05-21 | ||||||||||||||||||||||||||||
| Published: | 2019-05-21 | ||||||||||||||||||||||||||||
| Updated: | 2019-07-28 | ||||||||||||||||||||||||||||
| Summary: | Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. This vulnerability affects Firefox < 67. | ||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-20 | ||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2019-11696 Source: MISC Type: Exploit, Issue Tracking, Vendor Advisory https://bugzilla.mozilla.org/show_bug.cgi?id=1392955 Source: XF Type: UNKNOWN firefox-cve201911696-code-exec(161351) Source: CCN Type: Mozilla Foundation Security Advisory 2019-13 Security vulnerabilities fixed in Firefox 67 Source: MISC Type: Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2019-13/ Source: CCN Type: WhiteSource Vulnerability Database CVE-2019-11696 | ||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||