A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-firefoxalma-upgrade-thunderbird | May 4, 2022 | Mar 31, 2021 | |
| Alpine Linux | alpine-linux-upgrade-firefox-esralpine-linux-upgrade-firefoxalpine-linux-upgrade-thunderbirdalpine-linux-upgrade-librewolf | Jun 17, 2022 | Mar 31, 2021 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-thunderbirdamazon-linux-ami-2-upgrade-thunderbird-debuginfo | Apr 23, 2021 | Mar 31, 2021 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-firefox-debugsourcecentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfocentos-upgrade-thunderbird-debugsource | Mar 26, 2021 | Mar 25, 2021 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-thunderbird | Mar 26, 2021 | Mar 26, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | May 3, 2021 | Mar 31, 2021 | |
| Mfsa2021 10 | mozilla-firefox-upgrade-87_0 | Mar 24, 2021 | Mar 23, 2021 | |
| Mfsa2021 11 | mozilla-firefox-esr-upgrade-78_9 | Mar 24, 2021 | Mar 23, 2021 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-78_9 | Mar 24, 2021 | Mar 23, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-mail-thunderbird-78-9-0-11-4-32-0-1-88-3oracle-solaris-11-4-upgrade-web-browser-firefox-78-9-0-11-4-32-0-1-88-3oracle-solaris-11-4-upgrade-web-data-firefox-bookmarks-78-9-0-11-4-32-0-1-88-3 | Apr 21, 2021 | Mar 31, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | Mar 26, 2021 | Mar 23, 2021 |
| Redhat_linux | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-firefox-debugsourceredhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource | Mar 26, 2021 | Mar 25, 2021 | |
| Suse | — | suse-upgrade-mozilla-nsprsuse-upgrade-mozilla-nspr-32bitsuse-upgrade-mozilla-nspr-develsuse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-branding-slesuse-upgrade-mozillafirefox-branding-upstreamsuse-upgrade-mozillafirefox-buildsymbolssuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | Mar 31, 2021 | Mar 25, 2021 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | Mar 26, 2021 | Mar 25, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub