CVE-2019-17000

An object tag with a data URI did not correctly inherit the document's Content Security Policy

published January 8, 2020

CVSS
—
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy explicitly allowed data: URIs. This vulnerability affects Firefox < 70.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00805 · 56.3th percentile
Published
2020-01-08T20:04Z
EPSS history
Timeline
  • 08 JAN 20:04Z
    An object tag with a data URI did not correctly inherit the document's Content Security Policy
    cvelistv5