CVE-2021-43532

{"id": "CVE-2021-43532", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2021-12-08T22:15:09.367", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1719203", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2021-48/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. If a website tricked a user into copy and pasting the image link back to the page, the page would be able to steal the authentication tokens. This was fixed by making the action return the original URL, before any redirects. This vulnerability affects Firefox < 94."}, {"lang": "es", "value": "La acci\u00f3n del men\u00fa contextual \"Copy Image Link\" copiaba la URL de la imagen final despu\u00e9s de las redirecciones. Al insertar una imagen que desencadena flujos de autenticaci\u00f3n -junto con una pol\u00edtica de seguridad de contenidos que detuviera una cadena de redireccionamiento en el medio-, la URL de la imagen final podr\u00eda ser una que contuviera un token de autenticaci\u00f3n usado para hacerse con una cuenta de usuario. Si un sitio web enga\u00f1aba a un usuario para que copiara y pegara el enlace de la imagen de vuelta a la p\u00e1gina, \u00e9sta podr\u00eda robar los tokens de autenticaci\u00f3n. Esto fue corregido haciendo que la acci\u00f3n devolviera la URL original, antes de cualquier redirecci\u00f3n. Esta vulnerabilidad afecta a Firefox versiones anteriores a 94"}], "lastModified": "2021-12-10T16:54:21.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A22FDA8A-B862-4383-9C8E-C162713AB01B", "versionEndExcluding": "94.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}