CVE-2019-11747

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security (HSTS) settings received from sites that use it. Due to a bug, sites on the pre-load list also have their HSTS setting removed. On the next visit to that site if the user specifies an http: URL rather than secure https: they will not be protected by the pre-loaded HSTS setting. After that visit the site's HSTS setting will be restored. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-665

Affected software

No affected versions have been published.

Timeline

Published
Sep 27, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-117486.5WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party cCVE-2019-117494.3A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal CVE-2019-11757.0An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory. An attacker who successfully exploiCVE-2019-117506.5A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69 andCVE-2019-117518.8Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks oCVE-2019-117528.8It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and aCVE-2019-117537.8The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unpriviCVE-2019-117544.3When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious websiCVE-2019-117557.5A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signatureCVE-2019-117568.8Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnCVE-2019-117578.8When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. ThiCVE-2019-117588.8Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed e
CVE-2019-11747: Medium severity, CVSS 6.5 | Vulnix