CVE-2019-11595
CRITICALuBlock Origin < 0.9.5.15 - Remote Code Execution via $rewrite Filter Option
Title source: llmDescription
In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.
References (2)
Core 2
Core References
Exploit, Mitigation, Third Party Advisory x_refsource_misc
https://armin.dev/blog/2019/04/adblock-plus-code-injection/
Third Party Advisory x_refsource_misc
https://news.ycombinator.com/item?id=19666504
Scores
CVSS v3
9.0
EPSS
0.0241
EPSS Percentile
82.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Details
CWE
CWE-20
Status
published
Products (1)
ublockorigin/ublock_origin
< 0.9.5.15
Published
Apr 29, 2019
Tracked Since
Feb 18, 2026