Vulnerability · Published Jun 2, 2023 · Assigned by mozilla
CVE-2023-25741
Medium 6.5
In plain English
A medium-severity security flaw in Firefox from Mozilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.8%top 44.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility problems as well as this security concern, so the behavior was disabled until further review. This vulnerability affects Firefox < 110.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2023-25741 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2023-25741 |
Affected products (as reported)
Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N