CVE-2021-38497: mozilla firefox Origin Validation Error
CVSS: 6.5v3.1MediumModified
AliasesUBUNTU-CVE-2021-38497
Published 03-11-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-38497 is a medium (CVSS 6.5) Origin Validation Error vulnerability in mozilla firefox. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.2% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
0.59%
0%100%
Low · +0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 25 · Related 15MGASA-2021-0469MGASA-2021-0478OPENSUSE-SU-2021:1367-1OPENSUSE-SU-2021:1635-1OPENSUSE-SU-2021:3331-1OPENSUSE-SU-2021:3451-1OPENSUSE-SU-2021:4150-1OPENSUSE-SU-2024:11570-1OPENSUSE-SU-2024:11571-1OPENSUSE-SU-2024:14572-1RHSA-2021:3755RHSA-2021:3756RHSA-2021:3757RHSA-2021:3791RHSA-2021:3838RHSA-2021:3839RHSA-2021:3840RHSA-2021:3841SUSE-SU-2021:14826-1SUSE-SU-2021:3331-1SUSE-SU-2021:3446-1SUSE-SU-2021:3451-1SUSE-SU-2021:4150-1USN-5107-1USN-5248-1
Timeline
- 03-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
0.59%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.04 pp
From 0.55% on 19-09-2026
19-09-202619-10-2026
EPSS score0.59%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu6 products
- firefox< 93.0+build1-0ubuntu0.18.04.1 | < 93.0+build1-0ubuntu0.20.04.1
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
- mozjs78All versions (No fix recorded)
Mozilla3 products
- firefox≥ unspecified, < 93 | < 93.0
- firefox_esr≥ unspecified, < 91.2 | < 91.2
- thunderbird≥ unspecified, < 91.2 | < 91.2
2 vendors · 9 products