PT-2021-7431 · Mozilla · Firefox

Muneaki Nishimura · Published 2021-06-01 · Updated 2022-07-12 · CVE-2021-29958

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 34

Description The issue is related to errors in authorization, where the client fails to differentiate between normal and private browsing modes. This leads to the sharing of private mode cookies in normal browsing mode, potentially allowing a remote attacker to gain unauthorized access to protected information.

Recommendations For Firefox for iOS versions prior to 34, update to version 34 or later to resolve the issue. As a temporary workaround, consider avoiding the use of private browsing mode until the update is applied. Restrict access to sensitive information when using the browser in normal mode to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2022-06174

CVE-2021-29958

Affected Products

Firefox

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-29958 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1670127 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2021-25 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29958 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06174 · Security Note