CVE-2023-6206

Katalog CVE

CVSS 5.4 · Medium EPSS 0,56%

Kerentanan Improper Restriction of Rendered UI Layers or Frames pada mozilla firefox, mozilla firefox esr +2 lainnya. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

Rincian

Terbit di NVD

21 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1021: Improper Restriction of Rendered UI Layers or Frames

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2023-49/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2023-50/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2023-52/ release notes · advisory vendor
• https://www.debian.org/security/2023/dsa-5561 advisory pihak ketiga
• https://bugzilla.mozilla.org/show_bug.cgi?id=1857430 issue tracking · permissions required
• https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html mailing list
• https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html