VDB
CVE-2019-11748
CVE-2019-11748
PUBLISHED
CVSS 6.5 MEDIUM
WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile vulnerabilities in other software, a decision was made to no longer persist these permissions. This avoids the possibility of trusted WebRTC resources being invisibly embedded in web content and abusing permissions previously given by users. Users will now be prompted for permissions on each use. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
EPSS 1.03% · 62.5th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
1.03%
62.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:20.04:LTS | mozjs52 | 52.9.1-1ubuntu3, 52.9.1-1build1, 0 |
| Ubuntu:18.04:LTS | firefox | *, *, * |
| Ubuntu:18.04:LTS | mozjs38 | *, *, * |
| Ubuntu:18.04:LTS | mozjs52 | 52.3.1-7fakesync1, 52.8.1-0ubuntu0.18.04.1, 52.9.1-0ubuntu0.18.04.1 |
| Ubuntu:16.04:LTS | firefox | *, 64.0+build3-0ubuntu0.16.04.1, 65.0+build2-0ubuntu0.16.04.1 |
Timeline
- Sep 4, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 29, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 3, 2022 EPSS Score
- May 5, 2022 EPSS Score
- Jul 7, 2022 EPSS Score
- Sep 9, 2022 EPSS Score
- Nov 11, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-11748 third-party-advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/#CVE-2019-11748 third-party-advisory
- https://ubuntu.com/security/notices/USN-4122-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-11748 third-party-advisory