Improper Encoding or Escaping of Output
CVE-2023-23599
Summary
When copying a network request from the developer tools panel as a curl command the output was not properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox prior to 109, Thunderbird prior to 102.7, and Firefox ESR prior to 102.7.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- REQUIRED
- NONE
- NONE
- NONE
CWE-116 - Improper Encoding or Escaping of Output
The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
References
Advisory Timeline
- Published
