CVE-2021-29944 — Cross-site Scripting in Mozilla Firefox

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 40.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedJun 24
Latest updateMay 24

Description

Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 88.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶CVEListV5mozilla/firefoxunspecified — 88
▶NVDmozilla/firefox< 88.0
▶mozillamozilla/firefox

🔴Vulnerability Details

1
GHSA
GHSA-cg6w-97rj-9hvv: Lack of escaping allowed HTML injection when a webpage was viewed in Reader View↗2022-05-24
▶

📋Vendor Advisories

2
Debian
CVE-2021-29944: firefox - Lack of escaping allowed HTML injection when a webpage was viewed in Reader View...↗2021
▶
Mozilla
Mozilla Foundation Security Advisory 2021-16: CVE-2021-29944↗
▶