CVE-2024-5693 — Inclusion of Functionality from Untrusted Control Sphere in Mozilla Firefox
Severity
6.1MEDIUMNVD
OSV8.1
EPSS
1.5%
top 19.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 11
Latest updateJul 3
Description
Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages7 packages
🔴Vulnerability Details
4CVEList▶
CVE-2024-5693: Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin↗2024-06-11
GHSA▶
GHSA-pxf8-583j-3rmh: Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin↗2024-06-11
OSV▶
CVE-2024-5693: Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin↗2024-06-11
📋Vendor Advisories
7Debian▶
CVE-2024-5693: firefox - Offscreen Canvas did not properly track cross-origin tainting, which could be us...↗2024