PT-2023-6526 · Mozilla · Firefox

Irwan · Published 2023-10-24 · Updated 2024-01-07 · CVE-2023-5758

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 119

Description The issue is related to the reader mode in Firefox, where the structure of a web page is not properly protected, allowing for potential exploitation. This could lead to a reflected Cross-Site Scripting (XSS) attack, where an attacker-controlled script could execute when a page is opened in reader mode. The attack is conducted through a redirect URL.

Recommendations For Firefox for iOS versions prior to 119: Update to version 119 or later to resolve the issue. As a temporary workaround, consider avoiding the use of reader mode until the update is applied. Restrict access to potentially malicious websites to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07273

CVE-2023-5758

Affected Products

Firefox

References · 10

• https://bdu.fstec.ru/vul/2023-07273 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2023-48 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5758 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2023-48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5758 · Security Note
• https://vuldb.com/?id.243302 · Note
• https://security.gentoo.org/glsa/202401-10 · Note
• https://twitter.com/CVEnew/status/1716914367222976638 · Twitter Post
• https://bugzilla.mozilla.org/show_bug.cgi?id=1850019 · Note
• https://twitter.com/VulmonFeeds/status/1716921007468953643 · Twitter Post