CVE-2023-4047: CSRF

Q: What is the vulnerability ID for this bug in popup notifications delay calculation?

The vulnerability ID for this bug in popup notifications delay calculation is CVE-2023-4047.

Q: Which software is affected by this vulnerability?

This vulnerability affects Firefox versions < 116, Firefox ESR versions < 102.14, and Thunderbird versions < 115.1.

Q: What is the severity rating of CVE-2023-4047?

The severity rating of CVE-2023-4047 is high (8.8).

Q: How can I fix the vulnerability in Firefox and Thunderbird?

To fix the vulnerability in Firefox, update to version 116 or later. To fix the vulnerability in Thunderbird, update to version 115.1 or later.

Q: Where can I find more information about CVE-2023-4047?

You can find more information about CVE-2023-4047 on the Mozilla Security Advisories page: [Link](https://www.mozilla.org/security/advisories/mfsa2023-30/)

Published Aug 1, 2023

Updated

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.

Affected Software

25 affected componentsFixes available

redhat/firefox<102.14

102.14

redhat/firefox<115.1

115.1

redhat/thunderbird<102.14

102.14

redhat/thunderbird<115.1

115.1

Mozilla Thunderbird<115.1

115.1

Mozilla Thunderbird<102.14

102.14

Mozilla Firefox<116

116

Mozilla Firefox ESR<102.14

102.14

Mozilla Firefox ESR<115.1

115.1

Mozilla Firefox<116.0

Mozilla Firefox>=102.0<102.14

Mozilla Firefox>=115.0<115.1

Debian Debian Linux=11.0

Debian Debian Linux=12.0

Mozilla Firefox ESR>=102.0<102.14

Mozilla Firefox ESR>=115.0<115.1

debian/firefox

137.0.2-1

debian/firefox-esr

115.14.0esr-1~deb11u1128.9.0esr-1~deb11u1128.8.0esr-1~deb12u1128.9.0esr-1~deb12u1128.9.0esr-2

debian/thunderbird

1:115.12.0-1~deb11u11:128.9.0esr-1~deb11u11:128.8.0esr-1~deb12u11:128.9.0esr-1~deb12u11:128.9.0esr-1

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 116
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 137.0.2-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.9.0esr-1~deb12u1Fixed in 128.9.0esr-2
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:128.9.0esr-1~deb11u1Fixed in 1:128.8.0esr-1~deb12u1Fixed in 1:128.9.0esr-1~deb12u1Fixed in 1:128.9.0esr-1

Event History

Aug 1, 2023

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·02:57 PM

Data Sourced

via MITRE·02:57 PM

DescriptionWeakness

Data Sourced

03:15 PM

Description

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID for this bug in popup notifications delay calculation?

The vulnerability ID for this bug in popup notifications delay calculation is CVE-2023-4047.

Which software is affected by this vulnerability?

This vulnerability affects Firefox versions < 116, Firefox ESR versions < 102.14, and Thunderbird versions < 115.1.

What is the severity rating of CVE-2023-4047?

The severity rating of CVE-2023-4047 is high (8.8).

How can I fix the vulnerability in Firefox and Thunderbird?

To fix the vulnerability in Firefox, update to version 116 or later. To fix the vulnerability in Thunderbird, update to version 115.1 or later.

Where can I find more information about CVE-2023-4047?

You can find more information about CVE-2023-4047 on the Mozilla Security Advisories page: [Link](https://www.mozilla.org/security/advisories/mfsa2023-30/)

CVE-2023-4047: CSRF

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the vulnerability ID for this bug in popup notifications delay calculation?

Which software is affected by this vulnerability?

What is the severity rating of CVE-2023-4047?

How can I fix the vulnerability in Firefox and Thunderbird?

Where can I find more information about CVE-2023-4047?

Company

Resources

Contact