CVE-2023-23600

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was granted in. This lead to the possibility of notifications to be displayed during different browsing sessions. *This bug only affects Firefox for Android. Other operating systems are unaffected.* This vulnerability affects Firefox < 109.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-236016.5Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacksCVE-2023-236026.5A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. ThCVE-2023-236036.5Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting foCVE-2023-236046.5A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This couCVE-2023-236058.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugsCVE-2023-236068.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs showed evidence of meCVE-2023-236079.8erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to exCVE-2023-236084.3Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, CVE-2023-236097.4Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulneCVE-2023-23615.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-236106.5GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege ManagementCVE-2023-236115.4LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7
CVE-2023-23600: Medium severity, CVSS 6.5 | Vulnix