Уязвимость манипуляции историей сессий в Firefox из-за использования тестовой инфраструктуры
Описание
Скомпрометированный процесс содержимого способен выполнять манипуляции с историей сессий благодаря использованию тестовой инфраструктуры, которая не ограничена только тестовыми конфигурациями.
Затронутые версии ПО
- Firefox версии до 88
Тип уязвимости
Манипуляция данными
Ссылки
- Issue TrackingPermissions RequiredVendor Advisory
- Release NotesVendor Advisory
- Issue TrackingPermissions RequiredVendor Advisory
- Release NotesVendor Advisory
Уязвимые конфигурации
EPSS
4.3 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. This vulnerability affects Firefox < 88.
A compromised content process could have performed session history man ...
A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. This vulnerability affects Firefox < 88.
ALT-PU-2021-1676: package `firefox` update to version 88.0-alt1
ALT-PU-2021-2725: package `firefox-esr` update to version 91.0.1-alt1
EPSS
4.3 Medium
CVSS3
4.3 Medium
CVSS2