CVE-2017-7823: XSS
Last updated 24 July 2024
Other sources
The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
— Launchpad
The content security policy (CSP) sandbox directive did not create a unique origin for the document, causing it to behave as if the allow-same-origin keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content.
— Mozilla
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7823?
CVE-2017-7823 is a vulnerability in Mozilla Firefox and Thunderbird that allows for Cross-Site Scripting (XSS) attacks.
How does CVE-2017-7823 affect Mozilla Firefox and Thunderbird?
CVE-2017-7823 affects Mozilla Firefox versions up to and excluding 56.0, as well as Mozilla Thunderbird versions up to and excluding 52.4.0.
What is the severity of CVE-2017-7823?
CVE-2017-7823 has a severity rating of medium, with a CVSS score of 5.4.
How can I fix CVE-2017-7823?
To fix CVE-2017-7823, update your Mozilla Firefox to version 56.0 or later, and update your Mozilla Thunderbird to version 52.4.1 or later.
Where can I find more information about CVE-2017-7823?
You can find more information about CVE-2017-7823 on the Mozilla Bugzilla website, the Mozilla security advisories page, and the SecurityFocus website.