A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This is a separate bypass from CVE-2019-17000.*Note: This flaw only affected Firefox 69 and was not present in earlier versions.*. This vulnerability affects Firefox < 70.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-firefoxalpine-linux-upgrade-librewolf | Aug 22, 2024 | Jan 8, 2020 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jan 8, 2020 | |
| Mfsa2019 34 | mozilla-firefox-upgrade-70_0 | Oct 23, 2019 | Oct 22, 2019 | |
| Ubuntu | ubuntu-upgrade-firefox | Oct 24, 2019 | Oct 23, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub