CVE-2019-11761

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-362 CWE-862

Affected software

Vendor	Product	Versions
Mozilla	Firefox	before 70
Mozilla	Thunderbird	before 68.2
Mozilla	Firefox ESR	before 68.2

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1561502Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/202003-10Third Party Advisory
https://usn.ubuntu.com/4335-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-33/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-34/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-35/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1561502Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/202003-10Third Party Advisory
https://usn.ubuntu.com/4335-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-33/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-34/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-35/Vendor Advisory

Timeline

Published: Jan 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-117626.1If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/CVE-2019-117636.1Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have CVE-2019-117648.8Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed e CVE-2019-117656.5A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown.CVE-2019-117669.8dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature.CVE-2019-117675.8Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the CVE-2019-117689.8An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to tr CVE-2019-117697.8An issue was discovered in TeamViewer 14.2.2558. Updating the product as a non-administrative user requires entering administrative credenti CVE-2019-11777.0An elevation of privilege vulnerability exists in the way that the rpcss.dll handles objects in memory. An attacker who successfully exploit CVE-2019-117708.1In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTP CVE-2019-117717.8AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.CVE-2019-117729.8In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null