PT-2023-4149 · Mozilla · Firefox

Kazuki Nomoto · Publicado 2023-07-04 · Atualizado 2023-07-20 · CVE-2023-37455

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 115

Description The issue is related to the permission request prompt from a site in a background tab being overlaid on top of the site in the foreground tab. This can allow a remote attacker to perform a spoofing attack due to insufficient warning about potentially dangerous actions.

Recommendations For Firefox for iOS versions prior to 115, update to version 115 or later to resolve the issue.

Correção

Clickjacking

Enumeração de Fraquezas

CWE-357

CWE-1021

Identificadores relacionados

BDU:2023-04460

CVE-2023-37455

Produtos afetados

Firefox

Referências · 6

• https://mozilla.org/security/advisories/mfsa2023-25 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04460 · Nota de Segurança
• https://bugzilla.mozilla.org/show_bug.cgi?id=1786934 · Aviso do Fabricante
• https://t.me/cibsecurity/66557 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-37455 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37455 · Aviso do Fabricante