Critical · published December 22, 2022
🚨 A malicious website may sneak a peek at your cross-origin resource sizes with just a sneaky Range request! 🔥 Think of it like an uninvited guest at a buffet. They can't take any food, but they can definitely check out how much of each dish is available before deciding whether to crash the party! If exploited, this vulnerability could expose sensitive information about the size of resources between different origins, potentially paving the way for further attacks. Someone could gauge the importance of your data just by knowing how big it is, which could lead to a more significant breach!
Think of it like an uninvited guest at a buffet. They can't take any food, but they can definitely check out how much of each dish is available before deciding whether to crash the party! This vulnerability in Thunderbird (< 91.10), Firefox (< 101), and Firefox ESR (< 91.10) allows a malicious site to use Range requests to learn the sizes of cross-origin resources, which should typically be protected.
If exploited, this vulnerability could expose sensitive information about the size of resources between different origins, potentially paving the way for further attacks. Someone could gauge the importance of your data just by knowing how big it is, which could lead to a more significant breach! Update your Thunderbird to version 91.10 or later, and for Firefox, ensure you’re on version 101 or above. If you’re using Firefox ESR, upgrade to version 91.10 ASAP! You've got this! Stay ahead of the game and keep your systems secure. 🛡️