CVE-2023-6869

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

A

`<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to display under the guise of trusted content. This vulnerability affects Firefox < 121.

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1799036	Issue Tracking Permissions Required
https://security.gentoo.org/glsa/202401-10	Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-56/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1799036	Issue Tracking Permissions Required
https://security.gentoo.org/glsa/202401-10	Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-56/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:44

Type	Values Removed	Values Added
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=1799036 - Issue Tracking, Permissions Required~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=1799036 - Issue Tracking, Permissions Required
References	~~() https://security.gentoo.org/glsa/202401-10 - Third Party Advisory~~	() https://security.gentoo.org/glsa/202401-10 - Third Party Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2023-56/ - Vendor Advisory~~	() https://www.mozilla.org/security/advisories/mfsa2023-56/ - Vendor Advisory

Information

Published : 2023-12-19 14:15

Updated : 2025-05-07 21:16

NVD link : CVE-2023-6869

Mitre link : CVE-2023-6869

CVE.ORG link : CVE-2023-6869

JSON object : View

Products Affected

firefox

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-6869", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-12-19T14:15:08.040", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1799036", "tags": ["Issue Tracking", "Permissions Required"], "source": "[email protected]"}, {"url": "https://security.gentoo.org/glsa/202401-10", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-56/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1799036", "tags": ["Issue Tracking", "Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/202401-10", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-56/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to display under the guise of trusted content. This vulnerability affects Firefox < 121."}, {"lang": "es", "value": "Un elemento `<dialog>` podr\u00eda haber sido manipulado para pintar contenido fuera de un iframe en la sandbox. Esto podr\u00eda permitir que se muestre contenido que no es de confianza bajo la apariencia de contenido confiable. Esta vulnerabilidad afecta a Firefox < 121."}], "lastModified": "2025-05-07T21:16:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3D81D72-5965-4DB7-BFA7-9A32A9108919", "versionEndExcluding": "121.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}