CVE-2024-5689

In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and direct the user to a replica Firefox Screenshots page that could be used for phishing. This vulnerability affects Firefox < 127.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1389707	Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-25/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

History

13 Sep 2024, 18:35

Type	Values Removed	Values Added
Summary		(es) Además de detectar cuándo un usuario estaba tomando una captura de pantalla (XXX), un sitio web pudo superponer el botón "Mis fotos" que apareció y dirigir al usuario a una réplica de la página de capturas de pantalla de Firefox que podría usarse para phishing. Esta vulnerabilidad afecta a Firefox < 127.
CPE		cpe:2.3:a:mozilla:firefox::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
First Time		Mozilla Mozilla firefox
CWE		NVD-CWE-noinfo
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=1389707 -~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=1389707 - Issue Tracking, Permissions Required
References	~~() https://www.mozilla.org/security/advisories/mfsa2024-25/ -~~	() https://www.mozilla.org/security/advisories/mfsa2024-25/ - Vendor Advisory

11 Jun 2024, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-11 13:15

Updated : 2024-10-28 20:35

NVD link : CVE-2024-5689

Mitre link : CVE-2024-5689

CVE.ORG link : CVE-2024-5689

JSON object : View

Products Affected

mozilla

firefox

CWE

NVD-CWE-noinfo

{"id": "CVE-2024-5689", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-06-11T13:15:50.480", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1389707", "tags": ["Issue Tracking", "Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-25/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and direct the user to a replica Firefox Screenshots page that could be used for phishing. This vulnerability affects Firefox < 127."}, {"lang": "es", "value": "Adem\u00e1s de detectar cu\u00e1ndo un usuario estaba tomando una captura de pantalla (XXX), un sitio web pudo superponer el bot\u00f3n \"Mis fotos\" que apareci\u00f3 y dirigir al usuario a una r\u00e9plica de la p\u00e1gina de capturas de pantalla de Firefox que podr\u00eda usarse para phishing. Esta vulnerabilidad afecta a Firefox < 127."}], "lastModified": "2024-10-28T20:35:25.673", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CF5E7C8-8673-4B56-AF92-44C08B086E02", "versionEndExcluding": "127.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}