CVE-2021-29965
published 2021-06-24CVE-2021-29965: A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.74%
51.0th percentile
A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| mozilla | firefox | < 89.0 | 89.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= unspecified < 89 | 89 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.3MEDIUM
vendor_debian5.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-272h-q2v7-f686: A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the cur
ghsa_unreviewed·2022-05-24
CVE-2021-29965 [MEDIUM] CWE-610 GHSA-272h-q2v7-f686: A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the cur
A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
OSV
CVE-2021-29965: A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the cur
osv·2021-06-24·CVSS 5.3
CVE-2021-29965 [MEDIUM] CVE-2021-29965: A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the cur
A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
Debian
CVE-2021-29965: firefox - A malicious website that causes an HTTP Authentication dialog to be spawned coul...
vendor_debian·2021·CVSS 5.3
CVE-2021-29965 [MEDIUM] CVE-2021-29965: firefox - A malicious website that causes an HTTP Authentication dialog to be spawned coul...
A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2021-23: CVE-2021-29965
vendor_mozilla·CVSS 5.3
CVE-2021-29965 [MEDIUM] Mozilla Foundation Security Advisory 2021-23: CVE-2021-29965
Mozilla Foundation Security Advisory 2021-23
CVE: CVE-2021-29965
Product: Firefox
Impact: moderate
Fixed in: Firefox 89
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-06-24
Published