CVE-2019-11712

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
MozillaFirefox ESR>= unspecified, < 60.8
MozillaFirefox>= unspecified, < 68
MozillaThunderbird>= unspecified, < 60.8

References

Timeline

Published
Jul 23, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-117139.8A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially explCVE-2019-117149.8Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vuCVE-2019-117156.1Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards onCVE-2019-117168.3Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropeCVE-2019-117175.3A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allCVE-2019-117185.3Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream CVE-2019-117197.5When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the NetwCVE-2019-11724.3An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An CVE-2019-117206.1Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This aCVE-2019-117216.5The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks aCVE-2019-117237.5A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. ThiCVE-2019-117246.1Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redi
CVE-2019-11712: High severity, CVSS 8.8 | Vulnix