MozillaCVELIST:CVE-2023-23601

HistoryJun 02, 2023 - 12:00 a.m.

CVE-2023-23601

2023-06-0200:00:00

mozilla

www.cve.org

firefox

thunderbird

firefox esr

website spoofing

cross-origin iframe

security vulnerability

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

41.6%

JSON

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7.

CNA Affected

[
  {
    "vendor": "Mozilla",
    "product": "Firefox",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "109",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Mozilla",
    "product": "Thunderbird",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "102.7",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Mozilla",
    "product": "Firefox ESR",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "102.7",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

bugzilla.mozilla.org/show_bug.cgi?id=1794268

CVE-2023-23601

CNA Affected

References

Related