PT-2021-3995 · Mozilla+1 · Firefox For Android+1

Wladimir Palant · Published 2021-07-13 · Updated 2024-12-12 · CVE-2021-29973

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 90

Description The issue is related to the password autofill feature in Firefox for Android, which was enabled without user interaction on insecure websites. This allowed potential unauthorized access to protected information due to insufficient access control. The problem has been corrected to require user interaction before autofill functionality enters a user's password.

Recommendations For Firefox for Android versions prior to 90, update to version 90 or later to resolve the issue. As a temporary workaround, consider disabling the password autofill feature until the update is applied. Restrict access to sensitive information when using Firefox for Android versions prior to 90 to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2021-2261

ALT-PU-2021-3368

ALT-PU-2022-1782

BDU:2021-04517

CVE-2021-29973

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Firefox For Android

References · 1874

• https://mozilla.org/en-US/security/advisories/mfsa2021-28 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-29973 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29973 · Security Note
• https://mozilla.org/security/advisories/mfsa2021-28 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10600-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29973 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04517 · Security Note
• https://ubuntu.com/security/CVE-2021-29973 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2021-28/#CVE-2021-29973 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29973 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-2830 · Note
• https://suse.com/security/cve/CVE-2022-45421 · Note
• https://suse.com/security/cve/CVE-2017-7783 · Note
• https://suse.com/security/cve/CVE-2022-40960 · Note