cve/2019/CVE-2019-11751.md

### [CVE-2019-11751](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11751)
![](https://img.shields.io/static/v1?label=Product&message=Firefox%20ESR&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Firefox&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2068.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2069%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Malicious%20code%20execution%20through%20command%20line%20parameters&color=brighgreen)

### Description

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application. This can be used to write a log file to an arbitrary location such as the Windows 'Startup' folder. <br>*Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

### POC

#### Reference
- https://bugzilla.mozilla.org/show_bug.cgi?id=1572838

#### Github
No PoCs found on GitHub currently.