CVE-2023-34415 — Open Redirect in Mozilla Firefox
Severity
6.1MEDIUMNVD
OSV3.1
EPSS
0.1%
top 70.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 19
Latest updateJun 21
Description
When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data: URLs. This vulnerability affects Firefox < 114.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages5 packages
🔴Vulnerability Details
5GHSA▶
GHSA-7wmp-qghr-8g7f: When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in th↗2023-06-19
OSV▶
CVE-2023-34415: When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in th↗2023-06-07
📋Vendor Advisories
5Debian▶
CVE-2023-34415: firefox - When choosing a site-isolated process for a document loaded from a data: URL tha...↗2023