PT-2023-4149 · Mozilla · Firefox

Kazuki Nomoto · Published 2023-07-04 · Updated 2023-07-20 · CVE-2023-37455

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 115

Description The issue is related to the permission request prompt from a site in a background tab being overlaid on top of the site in the foreground tab. This can allow a remote attacker to perform a spoofing attack due to insufficient warning about potentially dangerous actions.

Recommendations For Firefox for iOS versions prior to 115, update to version 115 or later to resolve the issue.

Fix

Clickjacking

Weakness Enumeration

CWE-357

CWE-1021

Related Identifiers

BDU:2023-04460

CVE-2023-37455

Affected Products

Firefox

References · 6

• https://mozilla.org/security/advisories/mfsa2023-25 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04460 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1786934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37455 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37455 · Vendor Advisory
• https://t.me/cibsecurity/66557 · Telegram Post