CVE-2021-23984

Name
CVE-2021-23984
Description
A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2021-11/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2021-12/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2021-10/
Issue Tracking https://bugzilla.mozilla.org/show_bug.cgi?id=1693664
GENTOO https://security.gentoo.org/glsa/202104-09
GENTOO https://security.gentoo.org/glsa/202104-10

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* firefox >= None < 87.0
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* firefox_esr >= None < 78.9
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* thunderbird >= None < 78.9

Vulnerable and fixed packages

Source package Branch Version Maintainer Status