{"api_version":"1","generated_at":"2026-07-23T15:33:28+00:00","cve":"CVE-2021-29978","urls":{"html":"https://cve.report/CVE-2021-29978","api":"https://cve.report/api/cve/CVE-2021-29978.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-29978","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-29978"},"summary":{"title":"CVE-2021-29978","description":"Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability affects Mozilla VPN < 2.3.","state":"PUBLIC","assigner":"security@mozilla.org","published_at":"2021-08-05 20:15:00","updated_at":"2021-08-13 13:12:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/798","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/798","refsource":"MISC","tags":[],"title":"FVP-02-003 General: Balrog incorrectly verifies certificate chain · Issue #798 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/800","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/800","refsource":"MISC","tags":[],"title":"FVP-02-005 WP1-3: Authenticationlistener allows disturbance of login · Issue #800 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/797","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/797","refsource":"MISC","tags":[],"title":"FVP-02-002 WP1: Balrog does not verify certificate chain on macOS · Issue #797 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/808","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/808","refsource":"MISC","tags":[],"title":"FVP-02-012 WP5: Unencrypted shared preferences · Issue #808 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/805","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/805","refsource":"MISC","tags":[],"title":"FVP-02-010 WP5: Android app supports insecure v1 signature · Issue #805 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/803","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/803","refsource":"MISC","tags":[],"title":"FVP-02-008 WP5: Android app allows backups of application data · Issue #803 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/810","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/810","refsource":"MISC","tags":[],"title":"FVP-02-014 General: Cross-site WebSocket hijacking · Issue #810 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/804","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/804","refsource":"MISC","tags":[],"title":"FVP-02-009 WP5: Secure flag missing on views for Android app · Issue #804 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.mozilla.org/security/advisories/mfsa2021-31/","name":"https://www.mozilla.org/security/advisories/mfsa2021-31/","refsource":"MISC","tags":[],"title":"Multiple Low Security Issues in Mozilla VPN — Mozilla","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/801","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/801","refsource":"MISC","tags":[],"title":"FVP-02-006 WP3: Race condition in Ping Sender could expose gateway IP · Issue #801 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/809","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/809","refsource":"MISC","tags":[],"title":"FVP-02-013 WP5: Android app exposes sensitive data to system logs · Issue #809 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/pull/816","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/pull/816","refsource":"MISC","tags":[],"title":"FVP-02-005 WP1-3: Authenticationlistener allows disturbance of login by bakulf · Pull Request #816 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/812","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/812","refsource":"MISC","tags":[],"title":"FVP-02-016 OAuth: Auth code could be leaked by injecting port · Issue #812 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/806","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/806","refsource":"MISC","tags":[],"title":"FVP-02-011 API: Information disclosure via device endpoint · Issue #806 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/799","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/799","refsource":"MISC","tags":[],"title":"FVP-02-004 WP4: ATS policy unnecessarily weakened · Issue #799 · mozilla-mobile/mozilla-vpn-client · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29978","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29978","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"29978","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"mozilla_vpn","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2021-29978","ASSIGNER":"security@mozilla.org","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Mozilla","product":{"product_data":[{"product_name":"Mozilla VPN","version":{"version_data":[{"version_value":"2.3","version_affected":"<"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Multiple low security issues were discovered in a security audit of Mozilla VPN 2.0 branch"}]}]},"references":{"reference_data":[{"url":"https://www.mozilla.org/security/advisories/mfsa2021-31/","refsource":"MISC","name":"https://www.mozilla.org/security/advisories/mfsa2021-31/"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/797","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/797"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/798","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/798"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/799","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/799"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/800","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/800"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/801","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/801"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/803","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/803"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/804","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/804"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/805","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/805"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/806","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/806"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/808","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/808"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/809","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/809"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/810","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/810"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/812","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/issues/812"},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/pull/816","refsource":"MISC","name":"https://github.com/mozilla-mobile/mozilla-vpn-client/pull/816"}]},"description":{"description_data":[{"lang":"eng","value":"Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability affects Mozilla VPN < 2.3."}]}},"nvd":{"publishedDate":"2021-08-05 20:15:00","lastModifiedDate":"2021-08-13 13:12:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":10},"severity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mozilla:mozilla_vpn:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0","versionEndExcluding":"2.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"29978","Ordinal":"205209","Title":"CVE-2021-29978","CVE":"CVE-2021-29978","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"29978","Ordinal":"1","NoteData":"Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulnerability affects Mozilla VPN < 2.3.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"29978","Ordinal":"2","NoteData":"2021-08-05","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"29978","Ordinal":"3","NoteData":"2021-08-05","Type":"Other","Title":"Modified"}]}}}