CVE-2023-34414

{"id": "CVE-2023-34414", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "102.12", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "114", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "102.12", "versionType": "custom"}]}]}], "published": "2023-06-19T11:15:10.927", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1695986", "tags": ["Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://security.gentoo.org/glsa/202312-03", "source": "security@mozilla.org"}, {"url": "https://security.gentoo.org/glsa/202401-10", "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-19/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-20/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-21/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1695986", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/202312-03", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/202401-10", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-19/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-20/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2023-21/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "The error page for sites with invalid TLS certificates was missing the\nactivation-delay Firefox uses to protect prompts and permission dialogs\nfrom attacks that exploit human response time delays. If a malicious\npage elicited user clicks in precise locations immediately before\nnavigating to a site with a certificate error and made the renderer\nextremely busy at the same time, it could create a gap between when\nthe error page was loaded and when the display actually refreshed.\nWith the right timing the elicited clicks could land in that gap and \nactivate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12."}, {"lang": "es", "value": "La p\u00e1gina de error para sitios con certificados TLS no v\u00e1lidos carec\u00eda del retardo de activaci\u00f3n que Firefox utiliza para proteger las indicaciones y los di\u00e1logos de permisos de ataques que explotan los retrasos en el tiempo de respuesta humano. Si una p\u00e1gina maliciosa provocaba clics del usuario en ubicaciones precisas inmediatamente antes de navegar a un sitio con un error de certificado y hac\u00eda que el renderizador estuviera extremadamente ocupado al mismo tiempo, podr\u00eda crear una brecha entre el momento en que se cargaba la p\u00e1gina de error y el momento en que la pantalla se actualizaba realmente. Con la sincronizaci\u00f3n adecuada, los clics provocados podr\u00edan caer en esa brecha y activar el bot\u00f3n que anula el error de certificado para ese sitio. Esta vulnerabilidad afecta a Firefox ESR anterior a 102.12, Firefox menor que 114 y Thunderbird anterior a 102.12."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87A5ED08-8A22-4144-8223-261C87F2AEF4", "versionEndExcluding": "114.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3DC7FD5-B031-47F0-AC87-DA4D445F974E", "versionEndExcluding": "102.12"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20E9EB3F-4BB0-4C7A-A1A8-836E2CA174AD", "versionEndExcluding": "102.12"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}