CVE-2017-7815: Input Validation
Last updated 24 July 2024
Other sources
On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiprocess turned off. Installations with e10s turned on do not support the modal dialog functionality. This vulnerability affects Firefox < 56.
— Launchpad
On pages containing an iframe, the data: protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiprocess turned off. Installations with e10s turned on do not support the modal dialog functionality.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2017-7815.
What is the severity of CVE-2017-7815?
The severity of CVE-2017-7815 is medium with a CVSS score of 5.3.
Which software is affected by CVE-2017-7815?
Mozilla Firefox versions up to and excluding 56, as well as some Ubuntu and Debian packages, are affected by CVE-2017-7815.
How does CVE-2017-7815 work?
CVE-2017-7815 allows an attacker to create a modal dialog through JavaScript using the "data:" protocol, which can have an arbitrary domain as the dialog's location, spoofing the origin of the dialog from the user's view.
Where can I find more information about CVE-2017-7815?
You can find more information about CVE-2017-7815 on Bugzilla (https://bugzilla.mozilla.org/show_bug.cgi?id=1368981), the Mozilla Security Advisories (https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/), and SecurityFocus (http://www.securityfocus.com/bid/101057).