CVE-2019-17020

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the…

published January 8, 2020

CVSS
—
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01140 · 66.3th percentile
Published
2020-01-08T21:29Z
EPSS history
Timeline
  • 08 JAN 21:29Z
    If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the…
    cvelistv5