Open Redirect Affecting firefox package, versions <94.0-1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIANUNSTABLE-FIREFOX-2313661
- published 9 Dec 2021
- disclosed 8 Dec 2021
Introduced: 8 Dec 2021
CVE-2021-43532 Open this link in a new tabHow to fix?
Upgrade Debian:unstable firefox to version 94.0-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream firefox package and not the firefox package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. If a website tricked a user into copy and pasting the image link back to the page, the page would be able to steal the authentication tokens. This was fixed by making the action return the original URL, before any redirects. This vulnerability affects Firefox < 94.