CVE-2019-11761

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-362CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jan 8, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-117626.1If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/CVE-2019-117636.1Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could haveCVE-2019-117648.8Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed eCVE-2019-117656.5A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown.CVE-2019-117669.8dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature.CVE-2019-117675.8Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of theCVE-2019-117689.8An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trCVE-2019-117697.8An issue was discovered in TeamViewer 14.2.2558. Updating the product as a non-administrative user requires entering administrative credentiCVE-2019-11777.0An elevation of privilege vulnerability exists in the way that the rpcss.dll handles objects in memory. An attacker who successfully exploitCVE-2019-117708.1In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPCVE-2019-117717.8AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.CVE-2019-117729.8In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null