PT-2023-7113 · Mozilla · Firefox For Ios

Muneaki Nishimura · Published 2023-11-20 · Updated 2023-11-28 · CVE-2023-49061

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 120

Description The issue is related to the Reader Mode in Firefox for iOS, where the browser fails to neutralize HTML tags, allowing an attacker to perform HTML template injection. This could enable a remote attacker to gain unauthorized access to protected information and conduct cross-site scripting attacks. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 120, update to version 120 or later to resolve the issue. As a temporary workaround, consider disabling the Reader Mode feature until a patch is available. Restrict access to sensitive information when using the affected browser version to minimize the risk of exploitation.

Fix

Open Redirect

XSS

Code Injection

Weakness Enumeration

CWE-601

CWE-80

CWE-94

Related Identifiers

BDU:2023-08140

CVE-2023-49061

Affected Products

Firefox For Ios

References · 8

• https://bdu.fstec.ru/vul/2023-08140 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-49061 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49061 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2023-51 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2023-51 · Vendor Advisory
• https://vuldb.com/?id.245912 · Note
• https://cybersecurity-help.cz/vdb/SB2023112156 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1861420 · Note