CVE-2021-23963

EPSS 0.23%
Published 26.02.2021 03:15:14
Last modified 21.11.2024 05:52:06
Source security@mozilla.org
Teams watchlist Login
Open Login

When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version < 85.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.23%	0.428

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

https://www.mozilla.org/security/advisories/mfsa2021-03/

Vendor Advisory

Release Notes

https://bugzilla.mozilla.org/show_bug.cgi?id=1680793

Vendor Advisory

Issue Tracking

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2021-23963

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-23963

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-23963

EUVD