MEDIUM
The DOMParser API did not properly process '<noscript>' elements for escaping
Published Feb 26, 2021
6.1
MEDIUMCVSS 3.1
EPSS 0.75%
Description
The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86.
Affected products
-
Affected
- < 86
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (0)
No CWE recorded.
References (4)
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1528997%2C1683627 x_refsource_MISCIssue TrackingVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10895 Advisory
- https://security.gentoo.org/glsa/202104-10 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-07/ x_refsource_MISCRelease NotesVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://bugzilla.mozilla.org/buglist.cgi?bug_id=1528997%2C1683627 | x_refsource_MISCIssue TrackingVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10895 | Advisory | |
| https://security.gentoo.org/glsa/202104-10 | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| https://www.mozilla.org/security/advisories/mfsa2021-07/ | x_refsource_MISCRelease NotesVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mozilla
Published Feb 26, 2021
Updated Aug 3, 2024
Reserved Jan 13, 2021
Link CVE-2021-23974
CISA Vulnrichment
No data
Red Hat
No data
GitHub
No data