CVE-2019-11749

· MEDIUMModified

← All CVEs

CVSS v3.1

4.3

EPSS

0.90%

Published

Sep 27, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the system without triggering a user prompt or notification. This allows for the potential fingerprinting of users. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected Products (2)

mozilla · firefox (up to 69.0)vulnerable

mozilla · firefox_esr (up to 68.1.0)vulnerable

References (10)

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html

https://bugzilla.mozilla.org/show_bug.cgi?id=1565374

Issue TrackingPermissions RequiredVendor Advisory

https://www.mozilla.org/security/advisories/mfsa2019-25/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2019-26/

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html

KEV Catalog EPSS Scores Vendors All CVEs