CVE-2023-6868

2023-12-1913:38:50

mozilla

www.cve.org

cve-2023-6868

user-agent

push requests

vapid

empty messages

unauthorized parties

firefox

android

vulnerability

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

20.6%

JSON

In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties.
This bug only affects Firefox on Android. This vulnerability affects Firefox < 121.

CNA Affected

[
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "121",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]