CVE-2025-4088

EPSS 0.17%
Veröffentlicht 29.04.2025 13:13:43
Zuletzt bearbeitet 30.09.2026 18:10:00
Erkennungen
Login

Cross-site request forgery via storage access API redirects

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 6

NVD 2 VulnDex Vulnerability Enrichment 2

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mozilla ≫ Firefox SwEdition - Version < 138.0

Mozilla ≫ Thunderbird SwEdition - Version < 138.0

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.17%	0.065

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
CISA-ADP	6.5	3.9	2.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://www.mozilla.org/security/advisories/mfsa2025-28/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-31/

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=1953521

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2025-4088

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-4088

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-4088

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2025-4088