CVE-2024-8382

Sept. 6, 2024, 5:15 p.m.

CVSS Score

8.8 / 10

Products Impacted

Vendor Product Versions
mozilla
  • firefox
  • firefox_esr
  • *
  • *

Description

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

Weaknesses

Date

Published: Sept. 3, 2024, 1:15 p.m.

Last Modified: Sept. 6, 2024, 5:15 p.m.

Status : Modified

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@mozilla.org

CPEs

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a mozilla firefox / / / / / / / /
a mozilla firefox_esr / / / / / / / /
a mozilla firefox_esr / / / / / / / /

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score
8.8
Exploitability Score
2.8
Impact Score
5.9
Base Severity
HIGH
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References