PT-2022-6826 · Mozilla+9 · Thunderbird+11
Dave Vandyke
·
Published
2022-11-16
·
Updated
2025-01-10
·
CVE-2023-23602
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 109
Thunderbird versions prior to 102.7
Firefox ESR versions prior to 102.7
Description
A security issue was found in the handling of WebSocket creation within WebWorkers, causing the Content Security Policy
connect-src header to be bypassed. This could allow connections to restricted origins from inside WebWorkers. The vulnerability may be exploited by a remote attacker to impact data integrity.Recommendations
For Firefox versions prior to 109, update to version 109 or later to resolve the issue.
For Thunderbird versions prior to 102.7, update to version 102.7 or later to resolve the issue.
For Firefox ESR versions prior to 102.7, update to version 102.7 or later to resolve the issue.
Exploit
Fix
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Firefox
Firefox Esr
Linuxmint
Red Hat
Rocky Linux
Suse
Thunderbird
Ubuntu