CVE-2019-17020

MEDIUM

Firefox < 72.0 - Content Security Policy Bypass via XSL Stylesheet

Title source: llm
STIX 2.1

Description

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72.

References (3)

Core 3
Core References
Permissions Required x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1597645
Vendor Advisory x_refsource_confirm
https://www.mozilla.org/security/advisories/mfsa2020-01/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4234-1/

Scores

CVSS v3 6.5
EPSS 0.0023
EPSS Percentile 45.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-611
Status published
Products (5)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.04
canonical/ubuntu_linux 19.10
mozilla/firefox < 72.0
Published Jan 08, 2020
Tracked Since Feb 18, 2026