CVE-2024-8382

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8382
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1906744 Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-39/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-40/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-41/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-43/
https://www.mozilla.org/security/advisories/mfsa2024-44/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
History

06 Sep 2024, 17:15

Type Values Removed Values Added
Summary Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15. Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
References
  • () https://www.mozilla.org/security/advisories/mfsa2024-44/ -
  • () https://www.mozilla.org/security/advisories/mfsa2024-43/ -

04 Sep 2024, 15:10

Type Values Removed Values Added
References () https://www.mozilla.org/security/advisories/mfsa2024-41/ - () https://www.mozilla.org/security/advisories/mfsa2024-41/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2024-39/ - () https://www.mozilla.org/security/advisories/mfsa2024-39/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2024-40/ - () https://www.mozilla.org/security/advisories/mfsa2024-40/ - Vendor Advisory
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1906744 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1906744 - Issue Tracking, Permissions Required
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
First Time Mozilla firefox Esr
Mozilla firefox
Mozilla

03 Sep 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-03 13:15

Updated : 2024-10-30 17:35

NVD link : CVE-2024-8382

Mitre link : CVE-2024-8382

JSON object : View

Products Affected

mozilla

  • firefox
  • firefox_esr
CWE
NVD-CWE-noinfo