CVE-2024-10474

EPSS 0.1%
Published 29.10.2024 13:15:04
Last modified 13.03.2025 20:15:16
Source security@mozilla.org
Teams watchlist Login
Open Login

Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks This vulnerability affects Focus for iOS < 132.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Firefox Focus SwPlatformiphone_os Version < 132.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.1%	0.278

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.1	3.9	5.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://bugzilla.mozilla.org/show_bug.cgi?id=1863832

Issue Tracking

Permissions Required

https://www.mozilla.org/security/advisories/mfsa2024-60/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-10474

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-10474

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-10474

EUVD