CVE-2017-5451: mozilla firefox Improper Input Validation
Vulnerability summary
CVE-2017-5451 is a medium (CVSS 4.3) Improper Input Validation vulnerability in mozilla firefox. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 12 · Related 8Timeline
- 11-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
1.48%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
-0.03 pp
From 1.51% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.mozilla.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- enterprise_linuxEOL6.0 | 7.0
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.3 | 7.4
- enterprise_linux_server_eus7.3 | 7.4 | 7.5
Mozilla3 products
- firefox≥ unspecified, < 53 | < 53.0 | < 52.1.0
- firefox_esr≥ unspecified, < 52.1
- thunderbird≥ unspecified, < 52.1 | < 52.1.0
Ubuntu2 products
- firefox< 53.0+build6-0ubuntu0.14.04.1 | < 53.0+build6-0ubuntu0.16.04.1
- thunderbird< 1:52.1.1+build1-0ubuntu0.14.04.1 | < 1:52.1.1+build1-0ubuntu0.16.04.1
3 vendors · 11 products
References
13 links- bugzilla.mozilla.org/show_bug.cgi?id=1273537X Refsource CONFIRMExploitIssue TrackingPatchVendor Advisory