CVE-2021-43531

{"id": "CVE-2021-43531", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2021-12-08T22:15:09.310", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1659155", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2021-48/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redirect URL. This is related to CVE-2021-43532 but in the context of Web Extensions. This vulnerability affects Firefox < 94."}, {"lang": "es", "value": "Cuando un usuario cargaba un men\u00fa contextual de Extensiones Web, la Extensi\u00f3n Web pod\u00eda acceder a la URL posterior a la redirecci\u00f3n del elemento en el que se hac\u00eda clic. Si la Extensi\u00f3n Web carec\u00eda del permiso WebRequest para los hosts involucrados en la redirecci\u00f3n, esto ser\u00eda una violaci\u00f3n del mismo origen que filtrar\u00eda los datos a los que la Extensi\u00f3n Web deber\u00eda tener acceso. Esto se ha corregido para proporcionar la URL previa a la redirecci\u00f3n. Esto est\u00e1 relacionado con CVE-2021-43532 pero en el contexto de las Extensiones Web. Esta vulnerabilidad afecta a Firefox versiones anteriores a 94"}], "lastModified": "2021-12-10T16:55:28.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A22FDA8A-B862-4383-9C8E-C162713AB01B", "versionEndExcluding": "94.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}