CVE-2024-4765 — Use of a Broken or Risky Cryptographic Algorithm in Mozilla Firefox
Severity
8.1HIGHNVD
EPSS
0.2%
top 63.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 14
Description
Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context.
*This issue only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2
Affected Packages2 packages
🔴Vulnerability Details
2CVEList▶
CVE-2024-4765: Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest↗2024-05-14
GHSA▶
GHSA-vp32-xxhm-ppgv: Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest↗2024-05-14