6.1

CVE-2019-17022: canonical ubuntu_linux Cross-site Scripting

CVSS: 6.1v3.1MediumModified
AliasesUBUNTU-CVE-2019-17022DEBIAN-CVE-2019-17022
Published 08-01-2020Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2019-17022 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in canonical ubuntu_linux. EPSS estimates a 1.99% chance of exploitation in the next 30 days, higher than 80.3% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
1.99%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 12
DLA-2061-1DLA-2071-1DSA-4600-1DSA-4603-1MGASA-2020-0027MGASA-2020-0034

Timeline

  1. 08-01-2020
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

1.99%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

0.00 pp

From 1.99% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.99%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat5 products
Ubuntu4 products
  • firefox< 72.0.1+build1-0ubuntu0.16.04.1 | < 72.0.1+build1-0ubuntu0.18.04.1 | < 72.0.1+build1-0ubuntu1
  • mozjs38All versions (No fix recorded)
  • mozjs52All versions (No fix recorded)
  • thunderbird< 1:68.7.0+build1-0ubuntu0.16.04.2 | < 1:68.4.1+build1-0ubuntu0.18.04.1 | < 1:68.4.1+build1-0ubuntu1
Debian3 products
  • firefox-esr< 68.4.0esr-1
  • thunderbird< 1:68.4.1-1
  • debian_linuxEOL8.0 | 9.0 | 10.0
Mozilla2 products
Canonical1 product

5 vendors · 15 products

References

34 links
Show all 34 references