Reflected Cross-Site Scripting in Firefox for iOS by Mozilla
CVE-2023-5758

6.1MEDIUM

Key Information:

Vendor
Mozilla
Status
Firefox for iOS
Vendor
CVE Published:
25 October 2023

Summary

A reflected Cross-Site Scripting (XSS) vulnerability exists in Firefox for iOS when users open a page in reader mode. An attacker may exploit this flaw by manipulating the redirect URL, leading to the execution of attacker-controlled scripts in the context of the user's browser session. This poses a significant risk for users who visit maliciously crafted pages, potentially exposing sensitive information or allowing further attacks.

Affected Version(s)

Firefox for iOS < 119

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1850019
https://www.mozilla.org/security/advisories/mfsa2023-48/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Irwan
.