Vulnerability Description
The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 121.0 |
| Mozilla | Firefox Esr | < 115.6 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1863863Issue TrackingPermissions Required
- https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202401-10Third Party Advisory
- https://www.debian.org/security/2023/dsa-5581Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-54/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-56/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1863863Issue TrackingPermissions Required
- https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202401-10Third Party Advisory
- https://www.debian.org/security/2023/dsa-5581Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-54/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-56/Vendor Advisory
FAQ
What is CVE-2023-6867?
CVE-2023-6867 is a vulnerability with a CVSS score of 6.1 (MEDIUM). The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by ...
How severe is CVE-2023-6867?
CVE-2023-6867 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-6867?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Debian Debian Linux.