WebChannel APIs susceptible to confused deputy attack (Mozilla Firefox)
En bref
- Source
- NVD
- EPSS
- EPSS 0.60 % · centile 49 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mozilla
- Statut NVD
- Modified
Description
The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
Faiblesses (CWE)
- CWE-863 — Autorisation incorrecte
Références
- https://bugzilla.mozilla.org/show_bug.cgi?id=1915257
- https://www.mozilla.org/security/advisories/mfsa2025-01/
- https://www.mozilla.org/security/advisories/mfsa2025-02/
- https://www.mozilla.org/security/advisories/mfsa2025-04/
- https://www.mozilla.org/security/advisories/mfsa2025-05/
- https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-1569
- GCVE · GCVE-0-2025-0237
Avis du CERT-FR
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0019 — Multiples vulnérabilités dans Mozilla Thunderbird · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0009 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*< 128.6.0cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*< 134.0cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*< 128.6.0cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*≥ 129.0 < 134.0
Produits affectés
| Produit | Versions |
|---|---|
| Mozilla · Firefox | unaffected 128.6 ≤ 128.* ; unaffected 134 ≤ * |
| Mozilla · Thunderbird | unaffected 128.6 ≤ 128.* ; unaffected 134 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |