The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
A browser or email client should remove the `username:password` fragment from URLs before including them in CSP reports sent to the server. In vulnerable versions, this mechanism did not work correctly, so the full URL containing authentication credentials was saved and transmitted in the CSP report content. An attacker controlling the CSP report reception point or able to intercept them could read this data.
An attacker can obtain HTTP Basic Authentication credentials (login and password) of a user, which may lead to account takeover and unauthorized access to protected resources.
Update to Firefox 141, Firefox ESR 128.13 or Firefox ESR 140.1, and Thunderbird 141, Thunderbird 128.13 or Thunderbird 140.1, in which the vulnerability has been fixed.
Mozilla Firefox before version 141 and Firefox ESR before versions 128.13 and 140.1; Mozilla Thunderbird before version 141 and Thunderbird ESR before versions 128.13 and 140.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMozilla Firefox
APPMozilla< 128.13.0< 141.0140.0 – 140.1.0 (bez)Mozilla Thunderbird
APPMozilla< 128.13.0< 141.0140.0 – 140.1.0 (bez)
Related vulnerabilities
Use-after-free w Animation timelines Firefox/Thunderbird — RCE
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escap...
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes ...
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before...
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we ...