CVE-2023-23601

CVSS v3.1 6.5 (Medium)

EPSS 0.10 % (42^th)

Affected Products 3

Advisories 36

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7.

Weaknesses

CWE-346: Origin Validation Error

CVE Status: PUBLISHED
CNA: Mozilla Corporation
Published Date: 2023-06-02 17:15:10
(15 months ago)
Updated Date: 2023-06-08 18:55:24
(15 months ago)

Affected Products

Mozilla

Firefox
Firefox Esr
Thunderbird

Configuration #1

	CPE23	Up To
Mozilla Firefox prior 109.0 version	cpe:2.3:a:mozilla:firefox	< 109.0
Mozilla Firefox Esr prior 102.7 version	cpe:2.3:a:mozilla:firefox_esr	< 102.7
Mozilla Thunderbird prior 102.7 version	cpe:2.3:a:mozilla:thunderbird	< 102.7