CVE-2025-6433

Katalog CVE

CVSS 9.8 · Critical EPSS 0,30%

Kerentanan Improper Certificate Validation pada mozilla firefox. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability was fixed in Firefox 140 and Thunderbird 140.

Rincian

Terbit di NVD

24 Juni 2025

Terakhir diubah

30 September 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2025-51/ advisory vendor
• https://bugzilla.mozilla.org/show_bug.cgi?id=1954033 permissions required
• https://www.mozilla.org/security/advisories/mfsa2025-54/