CVE-2019-9803

The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be…

published April 26, 2019

CVSS
—
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some circumstances, allowing for potential man-in-the-middle attacks on the linked resources. This vulnerability affects Firefox < 66.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00559 · 45.8th percentile
Published
2019-04-26T16:13Z
EPSS history
Timeline
  • 26 APR 16:13Z
    The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be…
    cvelistv5