PT-2024-18134 · Mozilla+1 · Firefox+1

James Lee · Published 2024-02-22 · Updated 2024-02-22 · CVE-2024-1563

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Focus for iOS versions prior to 122

Description An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a timeout race condition.

Recommendations For Focus for iOS versions prior to 122, update to version 122 or later to resolve the issue. As a temporary workaround, consider restricting the use of custom Firefox schemes when opening external URLs to minimize the risk of exploitation.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2024-1563

Affected Products

Firefox

Focus

References · 5

• https://osv.dev/vulnerability/CVE-2024-1563 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1563 · Security Note
• https://mozilla.org/security/advisories/mfsa2024-09 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1863831 · Note
• https://twitter.com/CVEnew/status/1760684754511532076 · Twitter Post