#VU50879 Improperly implemented security check for standard


Published: 2021-02-23

Vulnerability identifier: #VU50879

Vulnerability risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-23969

CWE-ID: CWE-358

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Mozilla Firefox
Client/Desktop applications / Web browsers
Firefox ESR
Client/Desktop applications / Web browsers

Vendor: Mozilla

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect implementation of W3C Content Security Policy. Under certain types of redirects Firefox incorrectly sets the source file to be the destination of the redirects. A remote attacker can gain knowledge of the destination URL.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0 - 85.0.2

Firefox ESR: 78.0 - 78.7.1, 68.0 - 68.12.0, 60.0 - 60.9.0


CPE

External links
http://www.mozilla.org/en-US/security/advisories/mfsa2021-07/
http://www.mozilla.org/en-US/security/advisories/mfsa2021-08/


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?


Latest bulletins with this vulnerability