CVE-2021-38509 — UI Misrepresentation / Clickjacking in Mozilla Firefox
Severity
4.3MEDIUMNVD
OSV10.0OSV8.8
EPSS
0.4%
top 38.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 8
Latest updateJan 21
Description
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages9 packages
Also affects: Debian Linux 10.0, 11.0, 9.0
🔴Vulnerability Details
5GHSA▶
GHSA-hw7m-5984-jp2q: Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed o↗2021-12-09
CVEList▶
CVE-2021-38509: Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed o↗2021-12-08
OSV▶
CVE-2021-38509: Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed o↗2021-12-08
📋Vendor Advisories
8Debian▶
CVE-2021-38509: firefox - Due to an unusual sequence of attacker-controlled events, a Javascript alert() d...↗2021