{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2609", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2024-03-18T16:22:25.505Z", "datePublished": "2024-03-19T12:02:54.546Z", "dateUpdated": "2024-08-28T14:57:33.167Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThan": "124", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Firefox ESR", "vendor": "Mozilla", "versions": [{"lessThan": "115.10", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThan": "115.10", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10."}]}], "problemTypes": [{"descriptions": [{"description": "Permission prompt input delay could expire when not in focus", "lang": "en", "type": "text"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1866100"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-12/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-19/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-20/"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html"}], "credits": [{"lang": "en", "value": "Shaheen Fazim"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2024-04-19T16:50:48.947Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:18:48.164Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1866100", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-19/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-20/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "mozilla", "product": "firefox", "cpes": ["cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "124", "versionType": "custom"}]}, {"vendor": "mozilla", "product": "firefox_esr", "cpes": ["cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "115.10", "versionType": "custom"}]}, {"vendor": "mozilla", "product": "thunderbird", "cpes": ["cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "115.10", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-20T15:04:02.077172Z", "id": "CVE-2024-2609", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T14:57:33.167Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1866100", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-19/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-20/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:18:48.164Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-2609", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-20T15:04:02.077172Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"], "vendor": "mozilla", "product": "firefox", "versions": [{"status": "affected", "version": "0", "lessThan": "124", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"], "vendor": "mozilla", "product": "firefox_esr", "versions": [{"status": "affected", "version": "0", "lessThan": "115.10", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"], "vendor": "mozilla", "product": "thunderbird", "versions": [{"status": "affected", "version": "0", "lessThan": "115.10", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T14:56:13.841Z"}}], "cna": {"credits": [{"lang": "en", "value": "Shaheen Fazim"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "124", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "115.10", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "115.10", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1866100"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-12/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-19/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-20/"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html"}], "descriptions": [{"lang": "en", "value": "The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.", "supportingMedia": [{"type": "text/html", "value": "The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Permission prompt input delay could expire when not in focus"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2024-04-19T16:50:48.947Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2609", "state": "PUBLISHED", "dateUpdated": "2024-08-28T14:57:33.167Z", "dateReserved": "2024-03-18T16:22:25.505Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2024-03-19T12:02:54.546Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10."}, {"lang": "es", "value": "El retraso en la entrada del mensaje de permiso podr\u00eda haber expirado mientras la ventana no estaba enfocada, lo que hizo que el mensaje fuera vulnerable al clickjacking por parte de sitios web maliciosos. Esta vulnerabilidad afecta a Firefox &lt; 124."}], "id": "CVE-2024-2609", "lastModified": "2024-11-21T09:10:07.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-03-19T12:15:08.910", "references": [{"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1866100"}, {"source": "security@mozilla.org", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html"}, {"source": "security@mozilla.org", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2024-19/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2024-20/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1866100"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.mozilla.org/security/advisories/mfsa2024-19/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.mozilla.org/security/advisories/mfsa2024-20/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Awaiting Analysis"}

{"acknowledgement": "Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Shaheen Fazim as the original reporter.", "affected_release": [{"advisory": "RHSA-2024:1910", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:115.10.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1935", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:115.10.0-2.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2024-04-22T00:00:00Z"}, {"advisory": "RHSA-2024:1912", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:115.10.0-1.el8_9", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1939", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:115.10.0-2.el8_9", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-04-22T00:00:00Z"}, {"advisory": "RHSA-2024:1904", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "firefox-0:115.10.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1934", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "thunderbird-0:115.10.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-04-22T00:00:00Z"}, {"advisory": "RHSA-2024:1904", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "firefox-0:115.10.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1934", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "thunderbird-0:115.10.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2024-04-22T00:00:00Z"}, {"advisory": "RHSA-2024:1904", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "firefox-0:115.10.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1934", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "thunderbird-0:115.10.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2024-04-22T00:00:00Z"}, {"advisory": "RHSA-2024:1911", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "firefox-0:115.10.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1982", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "thunderbird-0:115.10.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-04-23T00:00:00Z"}, {"advisory": "RHSA-2024:1911", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "firefox-0:115.10.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1982", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "thunderbird-0:115.10.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-04-23T00:00:00Z"}, {"advisory": "RHSA-2024:1911", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "firefox-0:115.10.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1982", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "thunderbird-0:115.10.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-04-23T00:00:00Z"}, {"advisory": "RHSA-2024:1906", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "firefox-0:115.10.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1936", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "thunderbird-0:115.10.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2024-04-22T00:00:00Z"}, {"advisory": "RHSA-2024:1909", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "firefox-0:115.10.0-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1937", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "thunderbird-0:115.10.0-2.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-04-22T00:00:00Z"}, {"advisory": "RHSA-2024:1908", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:115.10.0-1.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1940", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:115.10.0-2.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-22T00:00:00Z"}, {"advisory": "RHSA-2024:1907", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "firefox-0:115.10.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1938", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "thunderbird-0:115.10.0-2.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2024-04-22T00:00:00Z"}, {"advisory": "RHSA-2024:1905", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "firefox-0:115.10.0-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-04-18T00:00:00Z"}, {"advisory": "RHSA-2024:1941", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "thunderbird-0:115.10.0-2.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-04-22T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Permission prompt input delay could expire when not in focus", "id": "2275551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275551"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-356", "details": ["The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.", "The Mozilla Foundation Security Advisory describes this flaw as:\nThe permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites."], "name": "CVE-2024-2609", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2024-04-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-2609\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-2609\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2024-19/#CVE-2024-2609\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2024-20/#CVE-2024-2609"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Moderate", "upstream_fix": "firefox 115.10, thunderbird 115.10"}