CVE-2024-5690 — Observable Discrepancy in Mozilla Firefox
Severity
4.3MEDIUMNVD
OSV8.1
EPSS
3.7%
top 12.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 11
Latest updateJul 3
Description
By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages9 packages
Also affects: Debian Linux 10.0
🔴Vulnerability Details
5CVEList▶
CVE-2024-5690: By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system↗2024-06-11
GHSA▶
GHSA-3fxj-qpxv-j6qj: By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system↗2024-06-11
OSV▶
CVE-2024-5690: By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system↗2024-06-11
📋Vendor Advisories
8Microsoft▶
By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ES↗2024-06-11
Debian▶
CVE-2024-5690: firefox - By monitoring the time certain operations take, an attacker could have guessed w...↗2024