When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically. This vulnerability affects Firefox < 90.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-firefoxalpine-linux-upgrade-librewolf | Aug 22, 2024 | Aug 5, 2021 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Aug 5, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Feb 22, 2022 | Aug 5, 2021 | |
| Mfsa2021 28 | mozilla-firefox-upgrade-90_0 | Jul 14, 2021 | Jul 13, 2021 | |
| Ubuntu | ubuntu-upgrade-firefox | Jul 17, 2021 | Jul 16, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub