CVE-2019-11696 describes a vulnerability in Firefox versions prior to 67 where .JNLP files, used for Java Web Start applications, are not recognized as executable content during download prompts. This oversight could lead to users inadvertently executing malicious Java binaries if Java is installed on their system. The vulnerability carries a high CVSS score of 7.8, indicating a local attack vector with low complexity, but potentially high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 67CPE match | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | ||
< 67.0CPE matchmatch criteria | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.