CVE-2017-7799

Mozilla: Self-XSS XUL injection in about:webrtc (MFSA 2017-18)

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.0

Review impact separately from score.

Published · August 8, 2017

Updated · November 22, 2025

Description

JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML". Data on this page is supplied by WebRTC usage and is not under third-party control, making this difficult to exploit, but the vulnerability could possibly be used for a cross-site scripting (XSS) attack. This vulnerability affects Firefox < 55.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')