CVE-2024-5687

If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the `Referer` and `Sec-*` headers, meaning there is the potential for incorrect security checks within the browser in addition to incorrect or misleading information sent to remote websites. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 127.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1889066	Issue Tracking Exploit
https://www.mozilla.org/security/advisories/mfsa2024-25/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1889066	Issue Tracking Exploit
https://www.mozilla.org/security/advisories/mfsa2024-25/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

History

27 Mar 2025, 20:13

Type	Values Removed	Values Added
First Time		Mozilla firefox Mozilla
CPE		cpe:2.3:a:mozilla:firefox::::::::
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=1889066 -~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=1889066 - Issue Tracking, Exploit
References	~~() https://www.mozilla.org/security/advisories/mfsa2024-25/ -~~	() https://www.mozilla.org/security/advisories/mfsa2024-25/ - Vendor Advisory

Information

Published : 2024-06-11 13:15

Updated : 2025-03-27 20:13

NVD link : CVE-2024-5687

Mitre link : CVE-2024-5687

CVE.ORG link : CVE-2024-5687

JSON object : View

Products Affected

mozilla

firefox

CWE

CWE-284

Improper Access Control

{"id": "CVE-2024-5687", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-06-11T13:15:50.260", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1889066", "tags": ["Issue Tracking", "Exploit"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-25/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1889066", "tags": ["Issue Tracking", "Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-25/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the `Referer` and `Sec-*` headers, meaning there is the potential for incorrect security checks within the browser in addition to incorrect or misleading information sent to remote websites.\n*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 127."}, {"lang": "es", "value": "Si se realiza una secuencia espec\u00edfica de acciones al abrir una nueva pesta\u00f1a, es posible que el principal desencadenante asociado con la nueva pesta\u00f1a haya sido incorrecto. El principal de activaci\u00f3n se utiliza para calcular muchos valores, incluidos los encabezados `Referer` y `Sec-*`, lo que significa que existe la posibilidad de que se realicen controles de seguridad incorrectos dentro del navegador, adem\u00e1s de informaci\u00f3n incorrecta o enga\u00f1osa enviada a sitios web remotos. *Este error s\u00f3lo afecta a Firefox para Android. Otras versiones de Firefox no se ven afectadas.* Esta vulnerabilidad afecta a Firefox < 127."}], "lastModified": "2025-03-27T20:13:57.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CF5E7C8-8673-4B56-AF92-44C08B086E02", "versionEndExcluding": "127.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}