CVE-2019-11738
Mozilla: Content security policy bypass through hash-based sources in directives
Severity
LowRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · September 3, 2019
Updated · November 22, 2025
Description
If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 5.8CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
CWE-358 · Improperly Implemented Security Check for Standard