If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1691153 | Exploit Issue Tracking Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2021-14/ | Release Notes Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2021-15/ | Release Notes Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2021-16/ | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
26 Apr 2022, 15:31
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-697 | |
| References | (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1691153 - Exploit, Issue Tracking, Vendor Advisory |
02 Jul 2021, 17:23
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 8.8 |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2021-14/ - Release Notes, Vendor Advisory | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2021-15/ - Release Notes, Vendor Advisory | |
| References | (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1691153 - Issue Tracking, Permissions Required, Vendor Advisory | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2021-16/ - Release Notes, Vendor Advisory | |
| CPE | cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
|
| CWE | CWE-269 |
24 Jun 2021, 14:20
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-06-24 14:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-23999
Mitre link : CVE-2021-23999
CVE.ORG link : CVE-2021-23999
JSON object : View
Products Affected
mozilla
- thunderbird
- firefox_esr
- firefox