CVE-2023-6868

2023-12-1913:38:50

mozilla

www.cve.org

cve-2023-6868

user-agent

push requests

vapid

empty messages

unauthorized parties

firefox

android

vulnerability

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.6%

JSON

In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties.
This bug only affects Firefox on Android. This vulnerability affects Firefox < 121.

CNA Affected

[
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "121",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]