CVE-2023-3482: Medium severity Mozilla Firefox vulnerability
When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission. This vulnerability affects Firefox < 115.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 115.0-1 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 115.0+ - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 123.0-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 115 - Configuration
Ensure Firefox is configured to block storage of all cookies to mitigate the ability of malicious websites to store tracking data without permission.
Mozilla Firefox cookie blocking = Block storage of all cookies - Compensating control
Disable or prevent use of iframes with source 'about:blank' in content rendered by the application/browser context to reduce the ability to store data in localStorage via an iframe.
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this Firefox vulnerability?
The vulnerability ID is CVE-2023-3482.
What is the severity level of CVE-2023-3482?
The severity level of CVE-2023-3482 is medium.
How does this vulnerability affect Firefox?
This vulnerability affects Firefox versions prior to 115.
How can data be stored in localstorage despite blocking cookies?
Data can be stored in localstorage by using an iframe with a source of 'about:blank', even when blocking cookies.
Are there any references related to CVE-2023-3482?
Yes, you can find more information about this vulnerability at the following links: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1839464), [Mozilla Security Advisories](https://www.mozilla.org/security/advisories/mfsa2023-22/), [Launchpad](https://launchpad.net/bugs/cve/CVE-2023-3482).