CVE-2019-13075

{"id": "CVE-2019-13075", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2019-06-30T14:15:09.483", "references": [{"url": "https://hackerone.com/reports/588239", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://trac.torproject.org/projects/tor/ticket/30657", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This is related to a behavior of Firefox before 68."}, {"lang": "es", "value": "El navegador Tor hasta la versi\u00f3n 8.5.3, presenta una vulnerabilidad de exposici\u00f3n de informaci\u00f3n. Permite a los atacantes remotos detectar el idioma del navegador por medio de vectores que incluyen un elemento IFRAME, debido a que el texto en ese idioma se incluye en el atributo title de un elemento LINK para una p\u00e1gina que no es HTML. Esto est\u00e1 relacionado con un comportamiento de Firefox anterior a versi\u00f3n 68."}], "lastModified": "2019-07-08T16:03:48.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:torproject:tor_browser:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74D64177-4EC7-418F-A6F9-E12AAFA3778F", "versionEndIncluding": "8.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}