Skip to content
Fencer Vulns
medium 6.5

CVE-2021-38505 json

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to th…

published 2021-12-08 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-24957

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. *This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Patch / fix

  • Mozilla Firefox 94
  • Mozilla Thunderbird 91.3
  • Mozilla Firefox ESR 91.3
  • MozillaThunderbird SLE Workstation Extension 15 SP3, SLE Workstation Extension 15 SP2 91.4.0-8.45.2
  • MozillaFirefox SLE Module for Desktop Applications 15 SP3, SLE Module for Desktop Applications 15 SP2 91.3.0-152.6.1
  • MozillaFirefox SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +11 more 91.3.0-112.80.2
  • MozillaFirefox SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +7 more 91.3.0-150.6.1

suse advisories SUSE-SU-2021:4150-1SUSE-SU-2021:3745-1SUSE-SU-2021:3721-1SUSE-SU-2021:3651-1

  • firefox-esr openSUSE Tumbleweed 128.5.1-1.1
  • MozillaThunderbird openSUSE Tumbleweed 91.3.0-1.1
  • MozillaFirefox openSUSE Tumbleweed 94.0.1-1.1
  • MozillaThunderbird openSUSE Leap 15.2 91.4.0-lp152.2.52.1
  • MozillaThunderbird openSUSE Leap 15.3 91.4.0-8.45.2
  • MozillaFirefox openSUSE Leap 15.3 91.3.0-152.6.1

opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:11607-1openSUSE-SU-2024:11614-1openSUSE-SU-2021:1635-1openSUSE-SU-2021:4150-1openSUSE-SU-2021:3745-1

  • firefox Alpine 3.23, Alpine 3.22, Alpine 3.21 +6 more 94.0-r0
  • librewolf Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 94.0-r0
  • firefox-esr Alpine 3.23, Alpine 3.22, Alpine 3.21 +6 more 91.3.0-r0
  • thunderbird Alpine 3.23, Alpine 3.22, Alpine 3.21 +5 more 91.3.2-r0

alpine advisories ALPINE-CVE-2021-38505

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-38505 updated cvss 7.5

Mozilla: Windows 10 Cloud Clipboard may have recorded sensitive user data

  • Red Hat Enterprise Linux 6 firefox
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 6 thunderbird Red Hat Enterprise Linux 7 firefox, thunderbird Red Hat Enterprise Linux 8 firefox, thunderbird
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • Mozilla Firefox
  • Mozilla Thunderbird
  • Mozilla Firefox ESR

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.