Note:
This project will be discontinued after December 13, 2021. [more]
2019-09-27
If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. This vulnerability affects Firefox < 69.
Products | Firefox |
Type | Insufficient Verification of Data Authenticity (CWE-345) |
First patch | - None (likely due to unavailable code) |
Links |
• https://bugzilla.mozilla.org/show_bug.cgi?id=1388015
• https://www.mozilla.org/security/advisories/mfsa2019-25/ |