description: If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
problem types: Content security policy bypass through hash-based sources in directives
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 69, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox ESR
vendor: Mozilla
versions:
lessThan: 68.1, status: affected, version: unspecified, versionType: custom
}
