CSS Sanitizer Incorrectly Rewrites @namespace Rule in Firefox ESR < 68.4 and Firefox < 72, Allowing for Data Exfiltration
CVE-2019-17016 · MEDIUM Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
Learn more about our Web App Pen Testing.