CVE-2019-11738

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs…

published September 27, 2019

CVSS
—
EPSS
1%
Percentile
73.1
In the wild
Unconfirmed
What it is

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01447 · 73.1th percentile
Published
2019-09-27T17:19Z
EPSS history
Timeline
  • 27 SEP 17:19Z
    If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs…
    cvelistv5