PT-2021-3661 · Mozilla+1 · Firefox For Android+1

Arturo Mejia · Published 2021-07-13 · Updated 2024-12-12 · CVE-2021-29971

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 90

Description The issue is related to insufficient access control in Firefox for Android, allowing any webpage running on the same host to be granted permissions previously saved by a user, regardless of the scheme or port. This could potentially allow a remote attacker to elevate their privileges. The vulnerability only affects Firefox for Android, with other operating systems being unaffected.

Recommendations For Firefox for Android versions prior to 90, update to version 90 or later to resolve the issue. As a temporary workaround, consider restricting the saving of permission grants to webpages to minimize the risk of exploitation.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

CWE-264

Related Identifiers

ALT-PU-2021-2261

ALT-PU-2021-3368

ALT-PU-2022-1782

BDU:2021-03891

CVE-2021-29971

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Firefox For Android

References · 1878

• https://mozilla.org/en-US/security/advisories/mfsa2021-28 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29971 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29971 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2021-28 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29971 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-29971 · Security Note
• https://bdu.fstec.ru/vul/2021-03891 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29971 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10600-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2021-28/#CVE-2021-29971 · Vendor Advisory
• https://suse.com/security/cve/CVE-2022-45420 · Note
• https://suse.com/security/cve/CVE-2012-3984 · Note
• https://suse.com/security/cve/CVE-2013-1721 · Note
• https://suse.com/security/cve/CVE-2023-5388 · Note