VDB

CVE-2018-12398

CVE-2018-12398 PUBLISHED CVSS 6.5 MEDIUM

By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy (CSP). This vulnerability affects Firefox < 63.

EPSS 1.62% · 75.1th percentile

Risk Scores

CVSS 3.0
6.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score
1.62%
75.1th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSfirefox60.0+build2-0ubuntu0.16.04.1, 60.0.2+build1-0ubuntu0.16.04.1, 61.0+build3-0ubuntu0.16.04.2
Ubuntu:20.04:LTSmozjs520, 52.9.1-1build1, 52.9.1-1ubuntu3
Ubuntu:18.04:LTSmozjs5252.9.1-0ubuntu0.18.04.1, 52.3.1-0ubuntu3, 0
Ubuntu:18.04:LTSmozjs3838.8.0~repack1-0ubuntu1, 0, *
Ubuntu:18.04:LTSfirefox61.0.1+build1-0ubuntu0.18.04.1, 62.0+build2-0ubuntu0.18.04.3, 62.0+build2-0ubuntu0.18.04.4
Ubuntu:14.04:LTSfirefox*, *, *

Timeline

  • Oct 24, 2018 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Oct 27, 2021 EPSS Score
  • Mar 2, 2022 EPSS Score
  • May 4, 2022 EPSS Score
  • Jul 6, 2022 EPSS Score
  • Sep 8, 2022 EPSS Score
  • Nov 10, 2022 EPSS Score
  • Jan 12, 2023 EPSS Score
  • Mar 7, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›