CVE-2017-7840: XSS
JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks if users were convinced to add malicious tags to bookmarks, export them, and then open the resulting file.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7840?
CVE-2017-7840 is a vulnerability that allows JavaScript code to be injected into an exported bookmarks file.
How does CVE-2017-7840 work?
CVE-2017-7840 works by placing JavaScript code into user-supplied tags in saved bookmarks, which is then executed when the exported HTML file is opened in a browser.
Which software is affected by CVE-2017-7840?
Mozilla Firefox versions up to 57.0.1 and Ubuntu Firefox versions up to 57.0+ are affected by CVE-2017-7840.
What is the severity of CVE-2017-7840?
CVE-2017-7840 has a severity rating of 6.1 (medium).
How can I fix CVE-2017-7840?
To fix CVE-2017-7840, it is recommended to update Mozilla Firefox to version 57.0.2 or later, or update Ubuntu Firefox to version 57.0.2 or later.