Lucene search

[email protected]CVE-2021-23985

HistoryMar 31, 2021 - 2:15 p.m.

CVE-2021-23985

2021-03-3114:15:19

[email protected]

web.nvd.nist.gov

cve

2021

23985

remote attacker

browsing activity

firefox

devtools

vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.003

Percentile

70.0%

JSON

If an attacker is able to alter specific about:config values (for example malware running on the user’s computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker (able to make a direct network connection to the victim) to monitor the user’s browsing activity and (plaintext) network traffic. This was addressed by providing a visual cue when Devtools has an open network socket. This vulnerability affects Firefox < 87.

Affected configurations

Vulners

NVD

Node

mozillafirefoxRange≤87

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::

CNA Affected

[
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "87",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]