5.3

CVE-2024-9398

By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox SwEdition esr Version < 128.3.0
Mozilla ≫ Firefox Version < 131.0
Mozilla ≫ Thunderbird Version < 128.3
Mozilla ≫ Thunderbird Version 129.0 Update beta
Mozilla ≫ Thunderbird Version 129.0 Update beta2
Mozilla ≫ Thunderbird Version 129.0 Update beta3
Mozilla ≫ Thunderbird Version 129.0 Update beta4
Mozilla ≫ Thunderbird Version 129.0 Update beta5
Mozilla ≫ Thunderbird Version 129.0 Update beta6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.426
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA-ADP 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

https://www.mozilla.org/security/advisories/mfsa2024-47/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-49/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-46/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-50/
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1881037
Issue Tracking
Permissions Required