CVE-2019-19916
MEDIUM
6,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none
MEDIUM
4,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: none
Integrity: partial
Availability: none
Description
AI Translation Available
In Midori Browser 0.5.11 (on Windows 10), Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type. This could result in script running where CSP should have blocked it, allowing for cross-site scripting (XSS) and other attacks when the product renders the content as HTML. Remediating this would also need to consider the polyglot case, e.g., a file that is a valid GIF image and also valid JavaScript.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0027
Percentile
0,5th
Updated
EPSS Score Trend (Last 90 Days)
79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
StableCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Integrity
Availability
Potential Impacts:
Bypass Protection Mechanism
Read Application Data
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
AI/ML, Web Based, Web Server
Application
Midori by Midori-Browser
CPE Identifier
View Detailed Analysis
cpe:2.3:a:midori-browser:midori:0.5.11:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://blog.mozilla.org/security/2016/08/26/mitigating-mime-confusion-attacks-…
https://github.com/V1n1v131r4/MIME-Confusion-Attack-on-Midori-Browser/blob/mast…
https://portswigger.net/research/bypassing-csp-using-polyglot-jpegs
https://blog.mozilla.org/security/2016/08/26/mitigating-mime-confusion-attacks-…
https://github.com/V1n1v131r4/MIME-Confusion-Attack-on-Midori-Browser/blob/mast…
https://portswigger.net/research/bypassing-csp-using-polyglot-jpegs