High severity7.1NVD Advisory· Published Feb 28, 2019· Updated Jun 17, 2026

CVE-2018-12397

Description

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Firefox4 versions
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <60.3.0
- (no CPE)range: <60.3
- (no CPE)range: unspecified
- (no CPE)range: unspecified
Canonical/Ubuntu Linux4 versions
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Desktop2 versions
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server2 versions
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation2 versions
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
osv-coords19 versions
pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%207
< 92.0-1.2+ 18 more
- (no CPE)range: < 92.0-1.2
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-3.17.1
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2
- (no CPE)range: < 60.3.0-109.50.2

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/105718nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1041944nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2018:3005nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:3006nvdThird Party Advisory
bugzilla.mozilla.org/show_bug.cginvdIssue TrackingPermissions RequiredVendor Advisory
lists.debian.org/debian-lts-announce/2018/11/msg00008.htmlnvdMailing ListThird Party Advisory
security.gentoo.org/glsa/201811-04nvdThird Party Advisory
usn.ubuntu.com/3801-1/nvdThird Party Advisory
www.debian.org/security/2018/dsa-4324nvdThird Party Advisory
www.mozilla.org/security/advisories/mfsa2018-26/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-27/nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.461
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000