PT-2021-7340 · Mozilla+4 · Firefox+4

Jan-Ivar Bruaroey · Published 2021-06-01 · Updated 2024-12-12 · CVE-2021-29959

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 89

Description The issue is related to errors in authorization, allowing a remote attacker to bypass existing security restrictions. Specifically, when a user has already allowed a website to access the microphone and camera, disabling camera sharing does not fully prevent the website from re-enabling it without an additional prompt, provided the website continues recording with the microphone until the camera is re-enabled.

Recommendations For versions prior to 89, update to version 89 or later to resolve the issue. As a temporary workaround, consider restricting access to the microphone and camera for websites that do not require them to function properly. Avoid using the camera and microphone permissions in sensitive contexts until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-264

Related Identifiers

ALT-PU-2021-1919

ALT-PU-2021-2725

ALT-PU-2021-2881

ALT-PU-2021-3368

ALT-PU-2021-3369

ALT-PU-2022-1781

ALT-PU-2022-1782

BDU:2022-05737

CVE-2021-29959

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-4978-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Ubuntu

References · 2184

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26976 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4047 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38473 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28289 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-29961 · Security Note