CVE-2024-29944

Katalog CVE

CVSS 8.4 · High EPSS 4,7%

Kerentanan Inclusion of Web Functionality from an Untrusted Source pada mozilla firefox, debian linux. Skor CVSS 3.1 8.4 (High) menurut CISA ADP.

Deskripsi (NVD)

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.

Rincian

Terbit di NVD

22 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.4 (High), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-830: Inclusion of Web Functionality from an Untrusted Source

EPSS (30 hari)

4,7% peluang dieksploitasi; lebih tinggi dari 91,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2024-15/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2024-16/ advisory vendor
• http://www.openwall.com/lists/oss-security/2024/03/23/1 mailing list
• https://bugzilla.mozilla.org/show_bug.cgi?id=1886852 issue tracking
• https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html mailing list