CVE-2019-11712: CSRF

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1543804
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-23/
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-28/
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
• https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html
• https://lists.debian.org/debian-lts-announce/2019/08/msg00002.html
• https://security.gentoo.org/glsa/201908-12
• https://security.gentoo.org/glsa/201908-20
• https://www.mozilla.org/security/advisories/mfsa2019-21/
• https://www.mozilla.org/security/advisories/mfsa2019-22/
• https://www.mozilla.org/security/advisories/mfsa2019-23/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2019-28
• MFSA2019-22
• MFSA2019-23
• MFSA2019-21

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2019-11711
• CVE-2019-11712
• CVE-2019-11713
• CVE-2019-11714
• CVE-2019-11729
• CVE-2019-11715
• CVE-2019-11716
• CVE-2019-11717
• CVE-2019-11719
• CVE-2019-11720
• CVE-2019-11721
• CVE-2019-11730
• CVE-2019-11723
• CVE-2019-11724
• CVE-2019-11725
• CVE-2019-11727
• CVE-2019-11728
• CVE-2019-11710
• CVE-2019-11709
• CVE-2019-9811
• CVE-2019-11718

Frequently Asked Questions

• What is CVE-2019-11712?

  CVE-2019-11712 is a vulnerability that allows POST requests made by NPAPI plugins to bypass CORS requirements, leading to potential Cross-Site Request Forgery (CSRF) attacks.

• Which software is affected by CVE-2019-11712?

  CVE-2019-11712 affects Firefox ESR versions prior to 60.8, Firefox versions prior to 68, and Thunderbird versions prior to 60.8.

• How severe is CVE-2019-11712?

  CVE-2019-11712 is classified as a high severity vulnerability with a CVSS score of 8.8.

• How can an attacker exploit CVE-2019-11712?

  An attacker can exploit CVE-2019-11712 by tricking a user into visiting a malicious website that contains a CSRF attack, potentially leading to unauthorized actions on the user's behalf.

• Is there a fix for CVE-2019-11712?

  Yes, updating to Firefox ESR 60.8, Firefox 68, or Thunderbird 60.8 or later versions will resolve the vulnerability.