{"containers": {"cna": {"affected": [{"product": "Firefox ESR", "vendor": "Mozilla", "versions": [{"lessThan": "78.10", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThan": "78.10", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThan": "88", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88."}], "problemTypes": [{"descriptions": [{"description": "Blob URLs may have been granted additional privileges", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-06-24T13:25:15", "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.mozilla.org/security/advisories/mfsa2021-14/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.mozilla.org/security/advisories/mfsa2021-16/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.mozilla.org/security/advisories/mfsa2021-15/"}, {"tags": ["x_refsource_MISC"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1691153"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@mozilla.org", "ID": "CVE-2021-23999", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Firefox ESR", "version": {"version_data": [{"version_affected": "<", "version_value": "78.10"}]}}, {"product_name": "Thunderbird", "version": {"version_data": [{"version_affected": "<", "version_value": "78.10"}]}}, {"product_name": "Firefox", "version": {"version_data": [{"version_affected": "<", "version_value": "88"}]}}]}, "vendor_name": "Mozilla"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Blob URLs may have been granted additional privileges"}]}]}, "references": {"reference_data": [{"name": "https://www.mozilla.org/security/advisories/mfsa2021-14/", "refsource": "MISC", "url": "https://www.mozilla.org/security/advisories/mfsa2021-14/"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2021-16/", "refsource": "MISC", "url": "https://www.mozilla.org/security/advisories/mfsa2021-16/"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2021-15/", "refsource": "MISC", "url": "https://www.mozilla.org/security/advisories/mfsa2021-15/"}, {"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1691153", "refsource": "MISC", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1691153"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:14:10.142Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2021-14/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2021-16/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2021-15/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1691153"}]}]}, "cveMetadata": {"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "cveId": "CVE-2021-23999", "datePublished": "2021-06-24T13:25:15", "dateReserved": "2021-01-13T00:00:00", "dateUpdated": "2024-08-03T19:14:10.142Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "05F82833-4C58-4D1A-B9FC-EDBE88FF93EA", "versionEndExcluding": "88.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "88984706-ACE5-4873-AC24-9D1670EE94F5", "versionEndExcluding": "78.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "362E8881-7A6C-400C-A128-BBA57710F340", "versionEndExcluding": "78.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88."}, {"lang": "es", "value": "Si una URL Blob se carg\u00f3 mediante alguna interacci\u00f3n inusual del usuario, podr\u00eda haber sido cargada por el Principal del Sistema y conceder privilegios adicionales que no deber\u00edan concederse al contenido web. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a 78.10, Thunderbird versiones anteriores a 78.10 y Firefox versiones anteriores a 88"}], "id": "CVE-2021-23999", "lastModified": "2022-04-26T15:31:31.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-06-24T14:15:09.477", "references": [{"source": "security@mozilla.org", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1691153"}, {"source": "security@mozilla.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2021-14/"}, {"source": "security@mozilla.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2021-15/"}, {"source": "security@mozilla.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2021-16/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-697"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Nika Layzell as the original reporter.", "affected_release": [{"advisory": "RHSA-2021:1350", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:78.10.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2021-04-26T00:00:00Z"}, {"advisory": "RHSA-2021:1363", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:78.10.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2021-04-26T00:00:00Z"}, {"advisory": "RHSA-2021:1353", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:78.10.0-1.el8_3", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2021-04-26T00:00:00Z"}, {"advisory": "RHSA-2021:1360", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:78.10.0-1.el8_3", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2021-04-26T00:00:00Z"}, {"advisory": "RHSA-2021:1351", "cpe": "cpe:/a:redhat:rhel_eus:8.1", "package": "thunderbird-0:78.10.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Extended Update Support", "release_date": "2021-04-26T00:00:00Z"}, {"advisory": "RHSA-2021:1362", "cpe": "cpe:/a:redhat:rhel_eus:8.1", "package": "firefox-0:78.10.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Extended Update Support", "release_date": "2021-04-26T00:00:00Z"}, {"advisory": "RHSA-2021:1352", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:78.10.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2021-04-26T00:00:00Z"}, {"advisory": "RHSA-2021:1361", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:78.10.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2021-04-26T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Blob URLs may have been granted additional privileges", "id": "1951368", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1951368"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-281", "details": ["If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88."], "name": "CVE-2021-23999", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2021-04-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-23999\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-23999\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2021-15/#CVE-2021-23999"], "threat_severity": "Moderate", "upstream_fix": "thunderbird 78.10, firefox 78.10"}