CVE-2021-4221

2022-12-2200:00:00

ubuntu.com

domain name

rtl character

firefox

android

user confusion

spoofing attack

vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

37.2%

JSON

If a domain name contained a RTL character, it would cause the domain to be
rendered to the right of the path. This could lead to user confusion and
spoofing attacks. <br>This bug only affects Firefox for Android. Other
operating systems are unaffected.<br>Note: Due to a clerical error this
advisory was not included in the original announcement, and was added in
Feburary 2022. This vulnerability affects Firefox < 92.