CVE-2017-5420: Input Validation
A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. This vulnerability affects Firefox < 52.
Other sources
A javascript: url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly.
Affected Software
Remediation
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5400
- CVE-2017-5401
- CVE-2017-5402
- CVE-2017-5403
- CVE-2017-5404
- CVE-2017-5406
- CVE-2017-5407
- CVE-2017-5410
- CVE-2017-5411
- CVE-2017-5409
- CVE-2017-5408
- CVE-2017-5412
- CVE-2017-5413
- CVE-2017-5414
- CVE-2017-5415
- CVE-2017-5416
- CVE-2017-5417
- CVE-2017-5425
- CVE-2017-5426
- CVE-2017-5427
- CVE-2017-5418
- CVE-2017-5419
- CVE-2017-5420
- CVE-2017-5405
- CVE-2017-5421
- CVE-2017-5422
- CVE-2017-5399
- CVE-2017-5398
Frequently Asked Questions
What is the severity of CVE-2017-5420?
CVE-2017-5420 is classified as a moderate severity vulnerability.
How do I fix CVE-2017-5420?
To fix CVE-2017-5420, upgrade to Firefox version 52 or newer.
What impact does CVE-2017-5420 have on users?
CVE-2017-5420 allows attackers to spoof URLs, potentially misleading users about the actual content of a page.
Which versions of Firefox are affected by CVE-2017-5420?
CVE-2017-5420 affects all Firefox versions prior to 52.
Is there a workaround for CVE-2017-5420?
There is no known workaround for CVE-2017-5420 other than updating to the patched version of Firefox.