PT-2023-7116 · Mozilla · Firefox

Muneaki Nishimura · Published 2023-11-20 · Updated 2023-11-30 · CVE-2023-49060

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 120

Description The issue is related to insufficient access control due to key filtering via the referrerpolicy attribute in Reader Mode. This could allow a remote attacker to elevate their privileges by ex-filtrating a security key.

Recommendations For versions prior to 120, update to version 120 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-264

Related Identifiers

BDU:2023-08143

CVE-2023-49060

Affected Products

Firefox

References · 8

• https://osv.dev/vulnerability/CVE-2023-49060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49060 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2023-51 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2023-51 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08143 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1861405 · Note
• https://vuldb.com/ru/?id.245910 · Note
• https://cybersecurity-help.cz/vdb/SB2023112156 · Note