CVE-2021-23972: High severity Mozilla Firefox vulnerability
One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser. This vulnerability affects Firefox < 86.
Other sources
One phishing tactic on the web is to provide a link with HTTP Auth. For example https://www.phishingtarget.com@evil.com. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 86 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 87.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 87.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2021-23972?
CVE-2021-23972 is classified as a moderate severity vulnerability.
How do I fix CVE-2021-23972?
To fix CVE-2021-23972, update your Mozilla Firefox to version 86.0 or later.
What kind of attack does CVE-2021-23972 protect against?
CVE-2021-23972 addresses phishing attacks that utilize HTTP Authentication links.
Is CVE-2021-23972 specific to any version of Firefox?
Yes, CVE-2021-23972 affects Mozilla Firefox versions prior to 86.
Does CVE-2021-23972 impact Thunderbird as well?
Yes, CVE-2021-23972 can also impact Mozilla Thunderbird, as it shares similar vulnerabilities with Firefox.