CVE-2023-23601
Mozilla Firefox ≤ 109.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-23601 is a medium-severity Origin Validation Error (CWE-346) vulnerability in Mozilla Firefox. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-27701
Vulnerability Data
Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires unique identification of the service before communications, addressing failures to validate the origin of the interaction.
Trusted path establishment enforces validation that the communication originates from and reaches only the intended trusted system components.
Enforces validation of the true origin of DNS responses via signatures and chain-of-trust mechanisms.
Enforces origin validation of name/address data, eliminating reliance on unverified or impersonated DNS sources.
Mandates origin validation so that only legitimate endpoints can continue the authenticated session.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls enforce origin validation at network boundaries.
Security of network services includes validating the authenticity of service endpoints.
A.8.26 requires identifying and specifying requirements for resilience against malicious attacks including SQL injections and input validation (items d, j), plus related protections (authentication, segregation, cryptography per 8.24), which can address some but not most origin validation scenarios such as those involving untrusted cross-origin requests or implicit trust in sources.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, zero-trust verification) plus design reviews that can catch and block origin-validation gaps in many common cases, but leaves a bounded remainder (e.g. protocol-level or third-party component origin errors not surfaced by the organization's review process).
Secure coding practices include implementing proper origin validation to prevent spoofing.
Secure authentication verifies identity but does not address origin validation of arbitrary data flows.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-346, a class-level weakness, and none of its children carries one either.