CVE-2023-4047: CSRF
First published: Tue Aug 01 2023(Updated: )
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.
Credit: security@mozilla.org security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox ESR | <102.14 | 102.14 |
| Mozilla Firefox ESR | <115.1 | 115.1 |
| Mozilla Thunderbird | <115.1 | 115.1 |
| Mozilla Thunderbird | <102.14 | 102.14 |
| redhat/firefox | <102.14 | 102.14 |
| redhat/firefox | <115.1 | 115.1 |
| redhat/thunderbird | <102.14 | 102.14 |
| redhat/thunderbird | <115.1 | 115.1 |
| Mozilla Firefox | <116 | 116 |
| Mozilla Firefox | <116.0 | |
| Mozilla Firefox ESR | >=102.0<102.14 | |
| Mozilla Firefox ESR | >=115.0<115.1 | |
| Debian Debian Linux | =11.0 | |
| Debian Debian Linux | =12.0 | |
| Mozilla Firefox | >=102.0<102.14 | |
| Mozilla Firefox | >=115.0<115.1 | |
| debian/firefox | 133.0.3-1 | |
| debian/firefox-esr | 115.14.0esr-1~deb11u1 128.5.0esr-1~deb11u1 128.3.1esr-1~deb12u1 128.5.0esr-1~deb12u1 128.5.0esr-1 128.5.1esr-1 | |
| debian/thunderbird | 1:115.12.0-1~deb11u1 1:128.5.0esr-1~deb11u1 1:115.16.0esr-1~deb12u1 1:128.5.0esr-1~deb12u1 1:128.5.0esr-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.mozilla.org/security/advisories/mfsa2023-30/
- https://www.mozilla.org/security/advisories/mfsa2023-31/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1839073
- https://www.mozilla.org/security/advisories/mfsa2023-29/
- https://www.debian.org/security/2023/dsa-5464
- https://www.debian.org/security/2023/dsa-5469
- https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
- https://launchpad.net/bugs/cve/CVE-2023-4047
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/#CVE-2023-4047
- https://access.redhat.com/errata/RHSA-2023:4460
- https://access.redhat.com/errata/RHSA-2023:4461
- https://access.redhat.com/errata/RHSA-2023:4462
- https://access.redhat.com/errata/RHSA-2023:4464
- https://access.redhat.com/errata/RHSA-2023:4463
- https://access.redhat.com/errata/RHSA-2023:4465
- https://access.redhat.com/errata/RHSA-2023:4469
- https://access.redhat.com/errata/RHSA-2023:4468
- https://access.redhat.com/errata/RHSA-2023:4492
- https://access.redhat.com/errata/RHSA-2023:4494
- https://access.redhat.com/errata/RHSA-2023:4493
- https://access.redhat.com/errata/RHSA-2023:4495
- https://access.redhat.com/errata/RHSA-2023:4496
- https://access.redhat.com/errata/RHSA-2023:4499
- https://access.redhat.com/errata/RHSA-2023:4497
- https://access.redhat.com/errata/RHSA-2023:4500
- https://access.redhat.com/security/cve/cve-2023-4047
- https://bugzilla.redhat.com/show_bug.cgi?id=2228362
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-29/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-29/#CVE-2023-4047
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/#CVE-2023-4047
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/#CVE-2023-4047
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/#CVE-2023-4047
- https://security-tracker.debian.org/tracker/CVE-2023-4047
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4047
- https://nvd.nist.gov/vuln/detail/CVE-2023-4047
- https://ubuntu.com/security/CVE-2023-4047
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the vulnerability ID for this bug in popup notifications delay calculation?
The vulnerability ID for this bug in popup notifications delay calculation is CVE-2023-4047.
Which software is affected by this vulnerability?
This vulnerability affects Firefox versions < 116, Firefox ESR versions < 102.14, and Thunderbird versions < 115.1.
What is the severity rating of CVE-2023-4047?
The severity rating of CVE-2023-4047 is high (8.8).
How can I fix the vulnerability in Firefox and Thunderbird?
To fix the vulnerability in Firefox, update to version 116 or later. To fix the vulnerability in Thunderbird, update to version 115.1 or later.
Where can I find more information about CVE-2023-4047?
You can find more information about CVE-2023-4047 on the Mozilla Security Advisories page: [Link](https://www.mozilla.org/security/advisories/mfsa2023-30/)
- collector/nvd-latest
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/severity
- agent/author
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-4047
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/event
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- agent/weakness
- agent/last-modified-date
- vendor/mozilla
- canonical/mozilla firefox esr
- canonical/mozilla thunderbird
- package-manager/redhat
- canonical/mozilla firefox
- version/mozilla firefox esr/102.0
- version/mozilla firefox esr/115.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/11.0
- version/debian debian linux/12.0
- package-manager/debian
- version/mozilla firefox/102.0
- version/mozilla firefox/115.0