Log in Start free

Vulnerability · Published Mar 31, 2021 · Assigned by mozilla

CVE-2021-23985

Medium 6.5

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.5%top 25.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker (able to make a direct network connection to the victim) to monitor the user's browsing activity and (plaintext) network traffic. This was addressed by providing a visual cue when Devtools has an open network socket. This vulnerability affects Firefox < 87.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20firefox87.0-r0ALPINE-CVE-2021-23985
Alpine:v3.21firefox87.0-r0ALPINE-CVE-2021-23985
Alpine:v3.22firefox87.0-r0ALPINE-CVE-2021-23985
Alpine:v3.23firefox87.0-r0ALPINE-CVE-2021-23985
Alpine:v3.21librewolf87.0-r0ALPINE-CVE-2021-23985
Alpine:v3.22librewolf87.0-r0ALPINE-CVE-2021-23985
Alpine:v3.23librewolf87.0-r0ALPINE-CVE-2021-23985
Alpine:v3.24librewolf87.0-r0ALPINE-CVE-2021-23985
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2021-23985

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 87

References