CVE-2024-26283

2024-02-2215:15:08

CWE-83

mozilla

web.nvd.nist.gov

4504

cve-2024-26283

unauthorized script execution

firefox

ios

vulnerability

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

Percentile

9.0%

JSON

An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.

Affected configurations

Vulners

Vulnrichment

Node

mozillafirefox_for_iosRange≤123

VendorProductVersionCPE
mozillafirefox_for_ios*cpe:2.3:a:mozilla:firefox_for_ios:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox_for_ios	*	cpe:2.3:a:mozilla:firefox_for_ios::::::::

CNA Affected

[
  {
    "product": "Firefox for iOS",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "123",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]