{
  "id": "CVE-2019-11707",
  "url": "https://spydr.io/cve/CVE-2019-11707",
  "published": "2019-07-23T14:15:15.233Z",
  "modified": "2026-06-17T02:13:28.073Z",
  "score": 8.8,
  "severity": "high",
  "cvss_version": "3.1",
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "score_source": "NVD",
  "epss": 0.37696,
  "epss_percentile": 0.98507,
  "exploited": true,
  "kev": {
    "added": "2022-05-23",
    "due": "2022-06-13",
    "action": "Apply updates per vendor instructions.",
    "ransomware": "Unknown",
    "name": "Mozilla Firefox and Thunderbird Type Confusion Vulnerability",
    "notes": "https://nvd.nist.gov/vuln/detail/CVE-2019-11707"
  },
  "ssvc_exploitation": "active",
  "vendors": [
    "Mozilla"
  ],
  "products": [
    "Mozilla Firefox ESR",
    "Mozilla Firefox",
    "Mozilla Thunderbird"
  ],
  "cwes": [
    "CWE-843"
  ],
  "description": "A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.",
  "status": "Analyzed",
  "score_type": "Primary",
  "scores": {
    "cvss_v40": null,
    "cvss_v31": 8.8,
    "cvss_v30": null
  },
  "references": [
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1544386",
      "tags": [
        "Issue Tracking",
        "Permissions Required",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://security.gentoo.org/glsa/201908-12",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2019-18/",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2019-20/",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707",
      "tags": [
        "US Government Resource"
      ]
    }
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11707",
  "covered_in": [],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}