Today > 13 Critical | 46 High | 88 Medium | 16 Low vulnerabilities   -   You can now download lists of IOCs here!

CVE-2025-0239

Jan. 9, 2025, 9:15 a.m.

Tags

CWE-295
security@mozilla.org
2025-01-07
CVE-2025-0239

CVSS Score

4.0 / 10

Product(s) Impacted

Firefox

  • < 134
  • < 128.6

Description

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird ESR < 128.6.

Weaknesses

CWE-295
Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

CWE ID: 295

Date

Published: Jan. 7, 2025, 4:15 p.m.

Last Modified: Jan. 9, 2025, 9:15 a.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@mozilla.org

CVSS Data

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Base Score
4.0
Exploitability Score
2.5
Impact Score
1.4
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://bugzilla.mozilla.org/ security@mozilla.org
https://www.mozilla.org/ security@mozilla.org
https://www.mozilla.org/ security@mozilla.org
https://www.mozilla.org/ security@mozilla.org
https://www.mozilla.org/ security@mozilla.org