CVE-2023-3482

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission. This vulnerability affects Firefox < 115.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 115

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1839464Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-22/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1839464Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-22/Vendor Advisory

Timeline

Published: Jul 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-348235.5fdkaac before 1.0.5 was discovered to contain a stack overflow in read_callback function in src/main.c.CVE-2023-348245.5fdkaac before 1.0.5 was discovered to contain a heap buffer overflow in caf_info function in caf_reader.c.CVE-2023-348296.5Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.CVE-2023-348305.4i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.CVE-2023-348315.4The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the subm CVE-2023-348329.8TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.CVE-2023-348336.1An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a cr CVE-2023-348345.3A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive CVE-2023-348355.4A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut CVE-2023-348365.4A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut CVE-2023-348375.4A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut CVE-2023-348385.4A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execut