CVE-2023-32210

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal. In certain circumstances it might have been possible to cause a document to be loaded with a higher privileged principal than intended. This vulnerability affects Firefox < 113.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 113

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1776755Permissions Required
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-16/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1776755Permissions Required
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-16/Vendor Advisory

Timeline

Published: Jun 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-322116.5A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thund CVE-2023-322124.3An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 1 CVE-2023-322138.8When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.CVE-2023-322147.5Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This attack only affects Windo CVE-2023-322158.8Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla CVE-2023-322169.8Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety b CVE-2023-322178.8IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 p CVE-2023-322186.1Avaya IX Workforce Engagement v15.2.7.1195 - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-322197.5A Mazda model (2015-2016) can be unlocked via an unspecified method.CVE-2023-32227.5Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote a CVE-2023-322209.8Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.CVE-2023-322217.8EaseUS Todo Backup version 20220111.390 - An omission during installation may allow a local attacker to perform privilege escalation.