CVE-2021-38503

EPSS 3.8%

Vexday Risk Score

3Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS —EPSS 3.8%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

08 dic 2021Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Productos afectados

Mozilla · Firefox Mozilla · Firefox ESR Mozilla · Thunderbird

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://bugzilla.mozilla.org/show_bug.cgi?id=1729517 https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html https://security.gentoo.org/glsa/202202-03 https://security.gentoo.org/glsa/202208-14 https://www.debian.org/security/2021/dsa-5026 https://www.debian.org/security/2022/dsa-5034 https://www.mozilla.org/security/advisories/mfsa2021-48/https://www.mozilla.org/security/advisories/mfsa2021-49/https://www.mozilla.org/security/advisories/mfsa2021-50/