CVE-2021-4140 - Vulnerability Details

Vendors	Products
Mozilla	Firefox Firefox Esr Thunderbird
Redhat	Enterprise Linux Rhel E4s Rhel Eus

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 7
firefox-0:91.5.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:0124	2022-01-12T00:00:00Z
thunderbird-0:91.5.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:0127	2022-01-12T00:00:00Z
Red Hat Enterprise Linux 8
thunderbird-0:91.5.0-1.el8_5	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:0129	2022-01-12T00:00:00Z
firefox-0:91.5.0-1.el8_5	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:0130	2022-01-12T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
firefox-0:91.5.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:0125	2022-01-12T00:00:00Z
thunderbird-0:91.5.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:0131	2022-01-12T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
thunderbird-0:91.5.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:0123	2022-01-12T00:00:00Z
firefox-0:91.5.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:0132	2022-01-12T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
firefox-0:91.5.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:0126	2022-01-12T00:00:00Z
thunderbird-0:91.5.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:0128	2022-01-12T00:00:00Z

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1746720
https://nvd.nist.gov/vuln/detail/CVE-2021-4140
https://www.cve.org/CVERecord?id=CVE-2021-4140
https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/#CVE-2021-4140
https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/#CVE-2021-4140
https://www.mozilla.org/security/advisories/mfsa2022-01/
https://www.mozilla.org/security/advisories/mfsa2022-02/
https://www.mozilla.org/security/advisories/mfsa2022-03/

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 10.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-4140", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2025-04-16T15:55:20.960Z", "dateReserved": "2021-12-20T00:00:00.000Z", "datePublished": "2022-12-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."}], "affected": [{"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"version": "unspecified", "lessThan": "91.5", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox", "versions": [{"version": "unspecified", "lessThan": "96", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"version": "unspecified", "lessThan": "91.5", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-01/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-02/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-03/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746720"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Iframe sandbox bypass with XSLT"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:16:04.229Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-01/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-02/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-03/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746720", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-91", "lang": "en", "description": "CWE-91 XML Injection (aka Blind XPath Injection)"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T15:55:14.536299Z", "id": "CVE-2021-4140", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T15:55:20.960Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2021-4140 (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

assignerShortName : mozilla (string)

dateUpdated : 2025-04-16T15:55:20.960Z (string)

dateReserved : 2021-12-20T00:00:00.000Z (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (string)

}

]

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 91.5 (string)

status : affected (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 96 (string)

status : affected (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 91.5 (string)

status : affected (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-02/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-03/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1746720 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : Iframe sandbox bypass with XSLT (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T17:16:04.229Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-02/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-03/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1746720 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-91 (string)

lang : en (string)

description : CWE-91 XML Injection (aka Blind XPath Injection) (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 9.8 (number)

attackVector : NETWORK (string)

baseSeverity : CRITICAL (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-16T15:55:14.536299Z (string)

id : CVE-2021-4140 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-16T15:55:20.960Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-01/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-02/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-03/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746720", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:16:04.229Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-4140", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-16T15:55:14.536299Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-91", "description": "CWE-91 XML Injection (aka Blind XPath Injection)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T15:55:07.068Z"}}], "cna": {"affected": [{"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.5", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "96", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.5", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-01/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-02/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-03/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746720"}], "descriptions": [{"lang": "en", "value": "It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Iframe sandbox bypass with XSLT"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2021-4140", "state": "PUBLISHED", "dateUpdated": "2025-04-16T15:55:20.960Z", "dateReserved": "2021-12-20T00:00:00.000Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2022-12-22T00:00:00.000Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-02/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-03/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1746720 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T17:16:04.229Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 9.8 (number)

attackVector : NETWORK (string)

baseSeverity : CRITICAL (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2021-4140 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-16T15:55:14.536299Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-91 (string)

description : CWE-91 XML Injection (aka Blind XPath Injection) (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-16T15:55:07.068Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.5 (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 96 (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.5 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-02/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-03/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1746720 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : Iframe sandbox bypass with XSLT (string)

}

]

}

]

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

cveMetadata : { »

cveId : CVE-2021-4140 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-16T15:55:20.960Z (string)

dateReserved : 2021-12-20T00:00:00.000Z (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

assignerShortName : mozilla (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "473CF696-0664-4239-995D-D4700507DD1A", "versionEndExcluding": "96.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8FD4DD9-9B65-49B3-9FED-6FF5085489D2", "versionEndExcluding": "91.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A101E0-2173-4299-8F05-F325DCDC804B", "versionEndExcluding": "91.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."}, {"lang": "es", "value": "Fue posible construir un marcado XSLT espec\u00edfico que podr\u00eda omitir un entorno limitado de iframe. Esta vulnerabilidad afecta a Firefox ESR &lt; 91.5, Firefox &lt; 96 y Thunderbird &lt; 91.5."}], "id": "CVE-2021-4140", "lastModified": "2025-04-16T16:15:19.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-22T20:15:12.250", "references": [{"source": "security@mozilla.org", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746720"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746720"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-91"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-91"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 473CF696-0664-4239-995D-D4700507DD1A (string)

versionEndExcluding : 96.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A8FD4DD9-9B65-49B3-9FED-6FF5085489D2 (string)

versionEndExcluding : 91.5 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A1A101E0-2173-4299-8F05-F325DCDC804B (string)

versionEndExcluding : 91.5 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (string)

}

1 : { »

lang : es (string)

value : Fue posible construir un marcado XSLT específico que podría omitir un entorno limitado de iframe. Esta vulnerabilidad afecta a Firefox ESR < 91.5, Firefox < 96 y Thunderbird < 91.5. (string)

}

]

id : CVE-2021-4140 (string)

lastModified : 2025-04-16T16:15:19.117 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 10 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2022-12-22T20:15:12.250 (string)

references : [ »

0 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Patch (string)

3 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1746720 (string)

}

1 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

}

2 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-02/ (string)

}

3 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-03/ (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Patch (string)

3 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1746720 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-02/ (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-03/ (string)

}

]

sourceIdentifier : security@mozilla.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-91 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-91 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2022:0124", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:91.5.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0127", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:91.5.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0129", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:91.5.0-1.el8_5", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0130", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:91.5.0-1.el8_5", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0125", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "firefox-0:91.5.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0131", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "thunderbird-0:91.5.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0123", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:91.5.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0132", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:91.5.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0126", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "firefox-0:91.5.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-01-12T00:00:00Z"}, {"advisory": "RHSA-2022:0128", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "thunderbird-0:91.5.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-01-12T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Iframe sandbox bypass with XSLT", "id": "2039568", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2039568"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-1021", "details": ["It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.", "The Mozilla Foundation Security Advisory describes this flaw as:\nIt was possible to construct specific XSLT markups that would enable someone to bypass an iframe sandbox."], "name": "CVE-2021-4140", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2022-01-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-4140\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-4140\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-02/#CVE-2021-4140\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-03/#CVE-2021-4140"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Important"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2022:0124 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : firefox-0:91.5.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-01-12T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2022:0127 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : thunderbird-0:91.5.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-01-12T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2022:0129 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : thunderbird-0:91.5.0-1.el8_5 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-01-12T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2022:0130 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : firefox-0:91.5.0-1.el8_5 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-01-12T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2022:0125 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : firefox-0:91.5.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-01-12T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2022:0131 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : thunderbird-0:91.5.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-01-12T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2022:0123 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : thunderbird-0:91.5.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-01-12T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2022:0132 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : firefox-0:91.5.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-01-12T00:00:00Z (string)

}

8 : { »

advisory : RHSA-2022:0126 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : firefox-0:91.5.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-01-12T00:00:00Z (string)

}

9 : { »

advisory : RHSA-2022:0128 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : thunderbird-0:91.5.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-01-12T00:00:00Z (string)

}

]

bugzilla : { »

description : Mozilla: Iframe sandbox bypass with XSLT (string)

id : 2039568 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2039568 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 9.6 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (string)

status : verified (string)

}

cwe : CWE-1021 (string)

details : [ »

0 : It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (string)

1 : The Mozilla Foundation Security Advisory describes this flaw as: It was possible to construct specific XSLT markups that would enable someone to bypass an iframe sandbox. (string)

]

name : CVE-2021-4140 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : firefox (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : thunderbird (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

]

public_date : 2022-01-11T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2021-4140 https://nvd.nist.gov/vuln/detail/CVE-2021-4140 https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/#CVE-2021-4140 https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/#CVE-2021-4140 (string)

]

statement : Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. (string)

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation poc

Automatable yes

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation poc

Automatable yes

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object