CVE-2021-23963

EPSS 0.23%
Veröffentlicht 26.02.2021 03:15:14
Zuletzt bearbeitet 21.11.2024 05:52:06
Quelle security@mozilla.org
Teams Watchlist Login
Unerledigt Login

When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version < 85.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.23%	0.428

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

https://www.mozilla.org/security/advisories/mfsa2021-03/

Vendor Advisory

Release Notes

https://bugzilla.mozilla.org/show_bug.cgi?id=1680793

Vendor Advisory

Issue Tracking

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2021-23963

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-23963

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-23963

EUVD