CVE-2021-38508 — UI Misrepresentation / Clickjacking in Mozilla Firefox
Severity
4.3MEDIUMNVD
OSV10.0OSV8.8
EPSS
0.3%
top 43.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 8
Latest updateJan 21
Description
By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages9 packages
Also affects: Debian Linux 10.0, 11.0, 9.0
🔴Vulnerability Details
5GHSA▶
GHSA-9mfh-2h7f-xf6h: By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message↗2021-12-09
OSV▶
CVE-2021-38508: By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message↗2021-12-08
CVEList▶
CVE-2021-38508: By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message↗2021-12-08