CVE-2024-2609

2024-03-1912:02:54

mozilla

github.com

permission prompt input

window focus

clickjacking

malicious websites

firefox

thunderbird

AI Score

6.2

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
    ],
    "vendor": "mozilla",
    "product": "firefox",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "124",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
    ],
    "vendor": "mozilla",
    "product": "firefox_esr",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "115.10",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"
    ],
    "vendor": "mozilla",
    "product": "thunderbird",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "115.10",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]