CVE-2024-8382

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8382
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1906744 Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-39/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-40/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-41/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-43/
https://www.mozilla.org/security/advisories/mfsa2024-44/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
History

06 Sep 2024, 17:15

Type Values Removed Values Added
Summary (en) Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15. (en) Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
References
  • () https://www.mozilla.org/security/advisories/mfsa2024-43/ -
  • () https://www.mozilla.org/security/advisories/mfsa2024-44/ -

04 Sep 2024, 15:10

Type Values Removed Values Added
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1906744 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1906744 - Issue Tracking, Permissions Required
References () https://www.mozilla.org/security/advisories/mfsa2024-39/ - () https://www.mozilla.org/security/advisories/mfsa2024-39/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2024-40/ - () https://www.mozilla.org/security/advisories/mfsa2024-40/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2024-41/ - () https://www.mozilla.org/security/advisories/mfsa2024-41/ - Vendor Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Summary
  • (es) Las interfaces de eventos internos del navegador quedaron expuestas al contenido web cuando se ejecutaban devoluciones de llamadas de escucha de EventHandler privilegiados para esos eventos. El contenido web que intentaba usar esas interfaces no podía usarlas con privilegios elevados, pero su presencia indicaría que se habían usado ciertas funciones del navegador, como cuando un usuario abría la consola de herramientas de desarrollo. Esta vulnerabilidad afecta a Firefox &lt; 130, Firefox ESR &lt; 128.2 y Firefox ESR &lt; 115.15.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
First Time Mozilla
Mozilla firefox
Mozilla firefox Esr

03 Sep 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-03 13:15

Updated : 2024-09-06 17:15

NVD link : CVE-2024-8382

Mitre link : CVE-2024-8382

CVE.ORG link : CVE-2024-8382

JSON object : View

Products Affected

mozilla

  • firefox
  • firefox_esr
CWE
NVD-CWE-noinfo