Vulnerability identifier: #VU51664
Vulnerability risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID:
CWE-ID:
CWE-451
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Mozilla Firefox
Client/Desktop applications /
Web browsers
Firefox ESR
Client/Desktop applications /
Web browsers
Vendor: Mozilla
Description
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data. A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Mozilla Firefox: 60.0 - 86.0.1
Firefox ESR: 60.0 - 60.9.0, 68.0 - 68.12.0, 78.0 - 78.8.0
External links
https://www.mozilla.org/en-US/security/advisories/mfsa2021-10/
https://www.mozilla.org/en-US/security/advisories/mfsa2021-11/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.