CVE-2024-9397

Description

A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Reserved 2024-10-01 | Published 2024-10-01 | Updated 2024-10-01 | Assigner mozilla

Problem types

Potential directory upload bypass via clickjacking

Product status

Any version before 131
affected

Any version before 128.3
affected

Any version before 128.3
affected

Any version before 131
affected

Credits

Shaheen Fazim

References

bugzilla.mozilla.org/show_bug.cgi?id=1916659

www.mozilla.org/security/advisories/mfsa2024-46/

www.mozilla.org/security/advisories/mfsa2024-47/

www.mozilla.org/security/advisories/mfsa2024-49/

www.mozilla.org/security/advisories/mfsa2024-50/

cve.org (CVE-2024-9397)

nvd.nist.gov (CVE-2024-9397)

Download JSON