CVE-2017-7835 describes a mixed content blocking bypass in Firefox versions prior to 57, where insecure HTTP sub-resources could be loaded on secure HTTPS pages if they redirected from HTTPS to HTTP. This vulnerability has a CVSS score of 7.3 (HIGH), indicating that an unauthenticated attacker could achieve low impact on confidentiality, integrity, and availability with low attack complexity. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the flaw could allow malicious scripts or content to bypass security measures.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 56.0.2CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | ||
< 57CPE match | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.