CVE-2018-18496

HIGH

Firefox < 64.0 - Clickjacking via RSS Feed Preview Frame

Title source: llm

Description

When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.*. This vulnerability affects Firefox < 64.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://www.mozilla.org/security/advisories/mfsa2018-29/

Issue Tracking, Permissions Required, Vendor Advisory x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=1422231

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/106167

Scores

CVSS v3 8.8

EPSS 0.0042

EPSS Percentile 61.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-1021

Status published

Products (1)

mozilla/firefox < 64.0

Published Feb 28, 2019

Tracked Since Feb 18, 2026