CVE-2021-23972 Security feature bypass in Firefox
Firefox failed to display phishing warnings for cached redirects, allowing attackers to bypass security prompts and facilitate phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-23972?
CVE-2021-23972 is a high-severity vulnerability in Mozilla Firefox, published on 26 Feb 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://[email protected]'. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser. This vulnerability affects Firefox < 86.
Which versions are affected by CVE-2021-23972?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2021-23972?
Upgrade to a fixed version.
Is CVE-2021-23972 being exploited?
There is no known exploitation of CVE-2021-23972 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-45hc-g9jq-5gv7, UBUNTU-CVE-2021-23972.