CVE-2021-23969

Katalog CVE

CVSS 4.3 · Medium EPSS 1,2%

Kerentanan pada mozilla firefox, mozilla firefox esr +2 lainnya. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

Rincian

Terbit di NVD

26 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1542194 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2021-07/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2021-08/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2021-09/ release notes · advisory vendor
• https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202104-09 advisory pihak ketiga
• https://security.gentoo.org/glsa/202104-10 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4866 advisory pihak ketiga