PT-2023-7115 · Mozilla+4 · Firefox+4
Muneaki Nishimura
·
Published
2023-11-20
·
Updated
2025-03-21
·
CVE-2023-6211
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 120
Description
The issue is related to the HTTPS-only mode in Firefox, where an attacker could trick a user into granting an HTTPS-only exception by getting them to participate in a clicking game, if the user had enabled HTTPS-only mode and was loading an insecure HTTP page. This could allow a remote attacker to conduct a clickjacking attack by exploiting errors in the user interface's information presentation.
Recommendations
For versions prior to 120, update to version 120 or later to resolve the issue. As a temporary workaround, consider avoiding participation in clicking games or other interactive elements when loading insecure HTTP pages in HTTPS-only mode. Restrict access to insecure HTTP pages to minimize the risk of exploitation.
Exploit
Fix
Clickjacking
UI Misrepresentation of Critical Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Firefox
Linuxmint
Ubuntu