1284470 - Local Cross-site Scripting Vulnerability found in mozilla browser version 47.0

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[geet]

Attachment: The vulnerability is local and based on "data:text/html;base64" on version 47.0.

Step to reproduce:

Step A - Follow the step shown in "http://www.securityfocus.com/archive/1/537275/30/0/threaded"

(payload) - <script>;prompt(0)</script>

Step B - Encode the payload using base64.

(Encoded payload) - PHNjcmlwdD47cHJvbXB0KDApPC9zY3JpcHQ+

Step C - Open you browser and then put above encoded payload with -

data:text/html;base64,{encoded Payload}

data:text/html;base64,PHNjcmlwdD47cHJvbXB0KDApPC9zY3JpcHQ+

Step D - Now hit enter and you will see pop-up.

Comment 1

[Al Billings [:abillings - ex-MoCo]]

This has been reported to us before, as the thread you link to mentions, and is an invalid issue.