CVE-2017-5389: Medium severity firefox vulnerability
WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51.
Other sources
WebExtensions could use the mozAddonManager API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission.
Affected Software
Remediation
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5375
- CVE-2017-5376
- CVE-2017-5377
- CVE-2017-5378
- CVE-2017-5379
- CVE-2017-5380
- CVE-2017-5390
- CVE-2017-5389
- CVE-2017-5396
- CVE-2017-5381
- CVE-2017-5382
- CVE-2017-5383
- CVE-2017-5384
- CVE-2017-5385
- CVE-2017-5386
- CVE-2017-5394
- CVE-2017-5391
- CVE-2017-5392
- CVE-2017-5393
- CVE-2017-5395
- CVE-2017-5387
- CVE-2017-5388
- CVE-2017-5374
- CVE-2017-5373
Frequently Asked Questions
What is the severity of CVE-2017-5389?
The severity of CVE-2017-5389 has been classified as critical due to its potential impact on user security.
How do I fix CVE-2017-5389?
To fix CVE-2017-5389, users should update their Mozilla Firefox browser to version 52 or later.
What causes CVE-2017-5389?
CVE-2017-5389 is caused by vulnerabilities in the "mozAddonManager" API that allow malicious extensions to install without user consent.
Which versions of Firefox are affected by CVE-2017-5389?
CVE-2017-5389 affects all Firefox versions prior to 52.
Can CVE-2017-5389 allow remote code execution?
Yes, CVE-2017-5389 can allow for remote code execution if exploited by a malicious extension.