CVE-2021-23972 - One phishing tactic on the web is to provide a link with HTTP Auth

Back Back to CVE browser

HIGH

One phishing tactic on the web is to provide a link with HTTP Auth

Published Feb 26, 2021

8.8

HIGH

CVSS 3.1

EPSS 1.01%

Description

One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser. This vulnerability affects Firefox < 86.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  < 86
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
< 86	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://bugzilla.mozilla.org/show_bug.cgi?id=1683536
x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://security.gentoo.org/glsa/202104-10
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-07/
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1683536		x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://security.gentoo.org/glsa/202104-10		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-07/		x_refsource_MISCRelease NotesVendor Advisory