{"api_version":"1","generated_at":"2026-04-23T01:19:11+00:00","cve":"CVE-2019-11761","urls":{"html":"https://cve.report/CVE-2019-11761","api":"https://cve.report/api/cve/CVE-2019-11761.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-11761","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-11761"},"summary":{"title":"CVE-2019-11761","description":"By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.","state":"PUBLIC","assigner":"security@mozilla.org","published_at":"2020-01-08 20:15:00","updated_at":"2023-02-01 14:08:00"},"problem_types":["CWE-362","CWE-862"],"metrics":[],"references":[{"url":"https://security.gentoo.org/glsa/202003-10","name":"GLSA-202003-10","refsource":"GENTOO","tags":[],"title":"Mozilla Thunderbird: Multiple vulnerabilities (GLSA 202003-10) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-35/","name":"https://www.mozilla.org/security/advisories/mfsa2019-35/","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Security vulnerabilities fixed in - Thunderbird 68.2 — Mozilla","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1561502","name":"https://bugzilla.mozilla.org/show_bug.cgi?id=1561502","refsource":"CONFIRM","tags":["Permissions Required"],"title":"1561502 - (CVE-2019-11761) By using a form with a data URI it's possible to gain access to the privileged JSONView object that has been cloned into content.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://usn.ubuntu.com/4335-1/","name":"USN-4335-1","refsource":"UBUNTU","tags":[],"title":"USN-4335-1: Thunderbird vulnerabilities | Ubuntu security notices","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-33/","name":"https://www.mozilla.org/security/advisories/mfsa2019-33/","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Security vulnerabilities fixed in - Firefox ESR 68.2 — Mozilla","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-34/","name":"https://www.mozilla.org/security/advisories/mfsa2019-34/","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Security vulnerabilities fixed in - Firefox 70 — Mozilla","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11761","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11761","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"11761","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"canonical","cpe5":"ubuntu_linux","cpe6":"16.04","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"esm","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11761","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11761","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11761","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox_esr","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11761","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox_esr","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11761","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"thunderbird","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11761","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"thunderbird","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2019-11761","qid":"296079","title":"Oracle Solaris 11.4 Support Repository Update (SRU) 15.5.0 Missing (CPUOCT2019)"},{"cve":"CVE-2019-11761","qid":"500923","title":"Alpine Linux Security Update for firefox-esr"},{"cve":"CVE-2019-11761","qid":"500944","title":"Alpine Linux Security Update for firefox"},{"cve":"CVE-2019-11761","qid":"503829","title":"Alpine Linux Security Update for firefox"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2019-11761","ASSIGNER":"security@mozilla.org","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Mozilla","product":{"product_data":[{"product_name":"Firefox","version":{"version_data":[{"version_value":"before 70"}]}},{"product_name":"Thunderbird","version":{"version_data":[{"version_value":"before 68.2"}]}},{"product_name":"Firefox ESR","version":{"version_data":[{"version_value":"before 68.2"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Unintended access to a privileged JSONView object"}]}]},"references":{"reference_data":[{"refsource":"CONFIRM","name":"https://www.mozilla.org/security/advisories/mfsa2019-35/","url":"https://www.mozilla.org/security/advisories/mfsa2019-35/"},{"refsource":"CONFIRM","name":"https://www.mozilla.org/security/advisories/mfsa2019-33/","url":"https://www.mozilla.org/security/advisories/mfsa2019-33/"},{"refsource":"CONFIRM","name":"https://www.mozilla.org/security/advisories/mfsa2019-34/","url":"https://www.mozilla.org/security/advisories/mfsa2019-34/"},{"refsource":"CONFIRM","name":"https://bugzilla.mozilla.org/show_bug.cgi?id=1561502","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1561502"},{"refsource":"GENTOO","name":"GLSA-202003-10","url":"https://security.gentoo.org/glsa/202003-10"},{"refsource":"UBUNTU","name":"USN-4335-1","url":"https://usn.ubuntu.com/4335-1/"}]},"description":{"description_data":[{"lang":"eng","value":"By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2."}]}},"nvd":{"publishedDate":"2020-01-08 20:15:00","lastModifiedDate":"2023-02-01 14:08:00","problem_types":["CWE-362","CWE-862"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.5},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*","versionEndExcluding":"68.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionEndExcluding":"68.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndExcluding":"70.0","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"11761","Ordinal":"150083","Title":"CVE-2019-11761","CVE":"CVE-2019-11761","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"11761","Ordinal":"1","NoteData":"By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"11761","Ordinal":"2","NoteData":"2020-01-08","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"11761","Ordinal":"3","NoteData":"2020-04-28","Type":"Other","Title":"Modified"}]}}}