Security restrictions bypass in Mozilla Firefox - CVE-2021-38491
Published: September 7, 2021
Vulnerability identifier: #VU56372
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-38491
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to Mixed-Content-Blocking was unable to check opaque origins. As a result, the mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded.
Affected software
Mozilla Firefox
Arch Linux
Gentoo Linux
Ubuntu
firefox (Ubuntu package)
Arch Linux
Gentoo Linux
Ubuntu
firefox (Ubuntu package)
How to mitigate CVE-2021-38491
Install updates from vendor's website.
Mozilla Firefox - update to 92.0
firefox (Ubuntu package) - addressed in versions 92.0+build3-0ubuntu0.18.04.1, 92.0+build3-0ubuntu0.20.04.1, 92.0+build3-0ubuntu0.21.04.1
firefox (Ubuntu package) - addressed in versions 92.0+build3-0ubuntu0.18.04.1, 92.0+build3-0ubuntu0.20.04.1, 92.0+build3-0ubuntu0.21.04.1