Уязвимость спуфинга в Mozilla Firefox при вводе URL-адреса в строке браузера
Описание
При вводе URL-адреса в адресной строке или строке поиска и быстром нажатии клавиши Enter, веб-сайт способен перехватить это событие и перенаправить пользователя до того, как будет осуществлён переход к желаемому введенному адресу. Для создания убедительного спуфинга злоумышленнику необходимо угадать, что пользователь вводит, возможно, косвенно предлагая это.
Затронутые версии ПО
- Firefox версий менее 84
Тип уязвимости
Спуфинг
Ссылки
- ExploitIssue TrackingPatchVendor Advisory
- Vendor Advisory
- ExploitIssue TrackingPatchVendor Advisory
- Vendor Advisory
Уязвимые конфигурации
EPSS
6.1 Medium
CVSS3
5.8 Medium
CVSS2
Дефекты
Связанные уязвимости
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability affects Firefox < 84.
When a user typed a URL in the address bar or the search bar and quick ...
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability affects Firefox < 84.
ALT-PU-2020-3529: package `firefox` update to version 84.0-alt1
ALT-PU-2021-2725: package `firefox-esr` update to version 91.0.1-alt1
EPSS
6.1 Medium
CVSS3
5.8 Medium
CVSS2