CVE-2025-8036
July 23, 2025, 3:15 p.m.
8.1
High
Description
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Mozilla |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-350
Reliance on Reverse DNS Resolution for a Security-Critical Action
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | mozilla | firefox | <141 | / | / | / | / | / | / | / |
| a | mozilla | firefox_esr | <140.1 | / | / | / | / | / | / | / |
| a | mozilla | thunderbird | <141 | / | / | / | / | / | / | / |
| a | mozilla | thunderbird_esr | <140.1 | / | / | / | / | / | / | / |
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- Scope: UNCHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: HIGH
- Availability Impact: NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Timeline
Published: July 22, 2025, 9:15 p.m.
Last Modified: July 23, 2025, 3:15 p.m.
Last Modified: July 23, 2025, 3:15 p.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security@mozilla.org
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.