CVE-2024-9397

MEDIUM

Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3 - CSRF

Title source: llm

Description

A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

References (5)

[Issue Tracking, Permissions Required] https://bugzilla.mozilla.org/show_bug.cgi?id=1916659

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2024-46/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2024-47/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2024-49/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2024-50/

Scores

CVSS v3 6.1

EPSS 0.0022

EPSS Percentile 44.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-1021

Status published

Products (4)

mozilla/firefox < 131.0

mozilla/firefox_esr < 128.3.0

mozilla/thunderbird 129.0 beta (6 CPE variants)

mozilla/thunderbird < 128.3

Published Oct 01, 2024

Tracked Since Feb 18, 2026