CVE-2024-8382

Katalog CVE

CVSS 8.8 · High EPSS 0,60%

Kerentanan Improper Check for Dropped Privileges pada mozilla firefox, mozilla firefox esr. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

Rincian

Terbit di NVD

3 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-273: Improper Check for Dropped Privileges

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2024-39/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2024-40/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2024-41/ advisory vendor
• https://bugzilla.mozilla.org/show_bug.cgi?id=1906744 issue tracking · permissions required
• https://www.mozilla.org/security/advisories/mfsa2024-43/
• https://www.mozilla.org/security/advisories/mfsa2024-44/
• https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html