CVE-2021-24002 — Injection in Mozilla Firefox
Severity
8.8HIGHNVD
OSV7.4
EPSS
0.5%
top 36.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 24
Latest updateMay 24
Description
When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages9 packages
🔴Vulnerability Details
6GHSA▶
GHSA-jvwq-53jx-c5f6: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed ar↗2022-05-24
CVEList▶
CVE-2021-24002: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed ar↗2021-06-24
OSV▶
CVE-2021-24002: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed ar↗2021-06-24
📋Vendor Advisories
8Debian▶
CVE-2021-24002: firefox - When a user clicked on an FTP URL containing encoded newline characters (%0A and...↗2021