CVE-2018-5157

HIGH

Firefox <60, Firefox ESR <52.8 - SSRF

Title source: llm

Description

Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.

References (11)

Scores

CVSS v3 7.5
EPSS 0.0059
EPSS Percentile 68.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE
CWE-346 CWE-200
Status published

Affected Products (18)

redhat/enterprise_linux_desktop
redhat/enterprise_linux_desktop
redhat/enterprise_linux_server
redhat/enterprise_linux_server
redhat/enterprise_linux_server_aus
redhat/enterprise_linux_server_eus
redhat/enterprise_linux_server_eus
redhat/enterprise_linux_server_tus
redhat/enterprise_linux_workstation
redhat/enterprise_linux_workstation
debian/debian_linux
debian/debian_linux
debian/debian_linux
canonical/ubuntu_linux
canonical/ubuntu_linux
... and 3 more

Timeline

Published Jun 11, 2018
Tracked Since Feb 18, 2026