CVE-2023-4045

MediumCVSS 5.3/10Last modified Oct 24, 2026

Description

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Aug 1, 2023
Last modified
Oct 24, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-404505.5The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may bypass Gatekeeper checks.CVE-2023-404518.8This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with JavaScript execution mCVE-2023-404527.1The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOCVE-2023-404536.5Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentiallyCVE-2023-404547.1A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7CVE-2023-4045510.0A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to cCVE-2023-404563.3The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to accessCVE-2023-40457The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause aCVE-2023-404587.5Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attackerCVE-2023-404597.5The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentiCVE-2023-40465.3In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilationCVE-2023-404605.4The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an a
CVE-2023-4045: Medium severity, CVSS 5.3 | Vulnix