Unrated severityNVD Advisory· Published Jun 2, 2023· Updated Dec 18, 2025
Calls to console.log allowed bypassing Content Security Policy via format directive
CVE-2023-23603
Description
Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
39< 102.7+ 3 more
- (no CPE)range: < 102.7
- (no CPE)range: < 109
- (no CPE)range: unspecified
- (no CPE)range: unspecified
< 102.7+ 1 more
- (no CPE)range: < 102.7
- (no CPE)range: unspecified
- osv-coords33 versionspkg:rpm/almalinux/firefoxpkg:rpm/almalinux/thunderbirdpkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/mozjs102&distro=openSUSE%20Tumbleweedpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP4pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP4
< 102.7.0-1.el9_1.alma+ 32 more
- (no CPE)range: < 102.7.0-1.el9_1.alma
- (no CPE)range: < 102.7.1-1.el8_7.alma
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 109.0-1.1
- (no CPE)range: < 102.7.1-150200.8.102.1
- (no CPE)range: < 102.7.1-1.1
- (no CPE)range: < 102.7.0-1.1
- (no CPE)range: < 102.7.0-150000.150.71.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-150000.150.71.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-112.145.1
- (no CPE)range: < 102.7.0-112.145.1
- (no CPE)range: < 102.7.0-112.145.1
- (no CPE)range: < 102.7.0-150000.150.71.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-112.145.1
- (no CPE)range: < 102.7.0-112.145.1
- (no CPE)range: < 102.7.0-150000.150.71.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-150200.152.73.1
- (no CPE)range: < 102.7.0-112.145.1
- (no CPE)range: < 102.7.0-112.145.1
- (no CPE)range: < 102.7.0-112.145.1
- (no CPE)range: < 102.7.1-150200.8.102.1
- (no CPE)range: < 102.7.1-150200.8.102.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.