Log in Start free

Vulnerability · Published Jun 2, 2023 · Assigned by mozilla

CVE-2023-23603Calls to console.log allowed bypassing Content Security Policy via format directive

Medium 6.5

In plain English

A medium-severity resource allocation without limits in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 49.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox102.7.0-1.el8_7.almaALSA-2023:0288
AlmaLinux:9firefox102.7.0-1.el9_1.almaALSA-2023:0285
AlmaLinux:8thunderbird102.7.1-1.el8_7.almaALSA-2023:0463
AlmaLinux:9thunderbird102.7.1-1.el9_1.almaALSA-2023:0476
Alpine:v3.20firefox-esr102.7.0-r0ALPINE-CVE-2023-23603
Alpine:v3.21firefox-esr102.7.0-r0ALPINE-CVE-2023-23603
Alpine:v3.22firefox-esr102.7.0-r0ALPINE-CVE-2023-23603
Alpine:v3.23firefox-esr102.7.0-r0ALPINE-CVE-2023-23603
Debian:12firefox-esr102.7.0esr-1DEBIAN-CVE-2023-23603
Debian:13firefox-esr102.7.0esr-1DEBIAN-CVE-2023-23603
Debian:14firefox-esr102.7.0esr-1DEBIAN-CVE-2023-23603
Debian:12thunderbird1:102.7.1-1DEBIAN-CVE-2023-23603
Debian:13thunderbird1:102.7.1-1DEBIAN-CVE-2023-23603
Debian:14thunderbird1:102.7.1-1DEBIAN-CVE-2023-23603
Rocky Linux:8firefox0:102.7.0-1.el8_7RLSA-2023:0288
Rocky Linux:9firefox0:102.7.0-1.el9_1RLSA-2023:0285
Rocky Linux:8thunderbird0:102.7.1-1.el8_7RLSA-2023:0463
Rocky Linux:9thunderbird0:102.7.1-1.el9_1RLSA-2023:0476
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2023-23603
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2023-23603
Ubuntu:22.04:LTSthunderbird1:102.7.1+build2-0ubuntu0.22.04.1USN-5824-1
Ubuntu:22.04:LTSthunderbird1:102.7.1+build2-0ubuntu0.22.04.1UBUNTU-CVE-2023-23603

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 109
Mozilla Firefox ESR unspecified – before 102.7
Mozilla Thunderbird unspecified – before 102.7

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References