CVE - CVE-2021-23969

CVE-ID
CVE-2021-23969	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
DEBIAN:DSA-4866 URL:https://www.debian.org/security/2021/dsa-4866 GENTOO:GLSA-202104-09 URL:https://security.gentoo.org/glsa/202104-09 GENTOO:GLSA-202104-10 URL:https://security.gentoo.org/glsa/202104-10 MISC:https://bugzilla.mozilla.org/show_bug.cgi?id=1542194 URL:https://bugzilla.mozilla.org/show_bug.cgi?id=1542194 MISC:https://www.mozilla.org/security/advisories/mfsa2021-07/ URL:https://www.mozilla.org/security/advisories/mfsa2021-07/ MISC:https://www.mozilla.org/security/advisories/mfsa2021-08/ URL:https://www.mozilla.org/security/advisories/mfsa2021-08/ MISC:https://www.mozilla.org/security/advisories/mfsa2021-09/ URL:https://www.mozilla.org/security/advisories/mfsa2021-09/ MLIST:[debian-lts-announce] 20210301 [SECURITY] [DLA 2578-1] thunderbird security update URL:https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html
Assigning CNA
Mozilla Corporation
Date Record Created
20210113	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210113)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)