CVE-2019-17020: XEE
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-17020?
CVE-2019-17020 is a vulnerability that allows an XML file with an XSL stylesheet to bypass the Content Security Policy.
What is the severity of CVE-2019-17020?
CVE-2019-17020 has a severity of 6.5, which is considered medium.
Which software products are affected by CVE-2019-17020?
Mozilla Firefox versions up to 72.0.1 and Ubuntu Linux with Firefox up to version 72.0.1 are affected by CVE-2019-17020.
How can I fix CVE-2019-17020?
To fix CVE-2019-17020, update Mozilla Firefox to version 72.0.1 or later, or update Ubuntu Linux with Firefox to version 72.0.1 or later.
Where can I find more information about CVE-2019-17020?
For more information about CVE-2019-17020, you can visit the following references: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1597645), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/)