CVE-2018-5152

MEDIUM

Firefox < 60.0 - WebExtension Content Script Network Traffic Interception

Title source: llm

Description

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts. This issue does not expose synchronization traffic directly and is limited to the process of user login to the website and the data displayed to the user once logged in. This vulnerability affects Firefox < 60.

References (6)

Core 6

Core References

Vendor Advisory x_refsource_confirm

https://www.mozilla.org/security/advisories/mfsa2018-11/

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1040896

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/3645-1/

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=1415644

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/104139

Issue Tracking, Permissions Required, Third Party Advisory x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=1427289

Scores

CVSS v3 6.5

EPSS 0.0046

EPSS Percentile 64.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE

CWE-327

Status published

Products (5)

canonical/ubuntu_linux 14.04

canonical/ubuntu_linux 16.04

canonical/ubuntu_linux 17.10

canonical/ubuntu_linux 18.04

mozilla/firefox < 60.0

Published Jun 11, 2018

Tracked Since Feb 18, 2026