CVE-2021-4140

Katalog CVE

CVSS 10.0 · Critical EPSS 1,4%

Kerentanan XML Injection (aka Blind XPath Injection) pada mozilla firefox, mozilla firefox esr +1 lainnya. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

Rincian

Terbit di NVD

22 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-91: XML Injection (aka Blind XPath Injection)

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1746720 exploit · issue tracking · patch · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-01/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-02/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-03/ advisory vendor