CVE-2024-9393Origin Validation Error in Mozilla Firefox

Severity
7.5HIGHNVD
EPSS
0.2%
top 59.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 1
Latest updateOct 7

Description

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages7 packages

CVEListV5mozilla/firefoxunspecified131
NVDmozilla/firefox< 131.0
CVEListV5mozilla/firefox_esrunspecified128.3+1
CVEListV5mozilla/thunderbirdunspecified128.3+1
NVDmozilla/firefox_esr116.0128.3.0+1

🔴Vulnerability Details

4
OSV
firefox vulnerabilities2024-10-07
GHSA
GHSA-rggh-rm3v-8xqj: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf2024-10-01
CVEList
CVE-2024-9393: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf2024-10-01
OSV
CVE-2024-9393: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf2024-10-01

📋Vendor Advisories

8
Ubuntu
Firefox vulnerabilities2024-10-07
Red Hat
firefox: thunderbird: Cross-origin access to PDF contents through multipart responses2024-10-01
Debian
CVE-2024-9393: firefox - An attacker could, via a specially crafted multipart response, execute arbitrary...2024
Mozilla
Mozilla Foundation Security Advisory 2024-49: CVE-2024-9393
Mozilla
Mozilla Foundation Security Advisory 2024-50: CVE-2024-9393
CVE-2024-9393 — Origin Validation Error in Mozilla | cvebase