« Back to list

CVE-2019-11723

Status: ModifiedHigh (7.5)—

A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different "containers" for people who use the Firefox Multi-Account Containers Web Extension. This vulnerability affects Firefox < 68.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Mozilla — FirefoxOpensuse — Leap

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2019-11723",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "Mozilla",
          "product": "Firefox",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "68",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-23T14:15:16.280",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1528335",
      "tags": [
        "Issue Tracking",
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201908-12",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2019-21/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1528335",
      "tags": [
        "Issue Tracking",
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201908-12",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2019-21/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different \"containers\" for people who use the Firefox Multi-Account Containers Web Extension. This vulnerability affects Firefox < 68."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad durante la instalación de complementos donde la captura inicial ignoró los atributos de origen del contexto de navegación. Esto podría filtrar cookies en el modo de navegación privada o en diferentes \"containers\" para personas que utilizan la Extensión Web de Contenedores de Cuentas Múltiples de Firefox. Esta vulnerabilidad afecta a Firefox anterior a versión 68."
    }
  ],
  "lastModified": "2026-06-17T02:13:30.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB53FE62-B5D2-497B-A7E3-40FFE81A9653",
              "versionEndExcluding": "68.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1E78106-58E6-4D59-990F-75DA575BFAD9"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}