CVE-2025-8031

CRITICAL

Mozilla Firefox < 128.13.0 - Incorrect Default Permissions

Title source: rule

Description

The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

References (8)

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html

[Permissions Required] https://bugzilla.mozilla.org/show_bug.cgi?id=1971719

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-56/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-58/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-59/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-61/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-62/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-63/

Scores

CVSS v3 9.8

EPSS 0.0014

EPSS Percentile 33.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-276

Status published

Products (10)

mozilla/firefox < 128.13.0

mozilla/firefox < 141.0

Mozilla/Firefox 128.13 - 128.*

Mozilla/Firefox 140.1 - 140.*

Mozilla/Firefox 141

mozilla/thunderbird < 128.13.0

mozilla/thunderbird < 141.0

Mozilla/Thunderbird 128.13 - 128.*

Mozilla/Thunderbird 140.1 - 140.*

Mozilla/Thunderbird 141

Published Jul 22, 2025

Tracked Since Feb 18, 2026