PT-2024-3797 · Mozilla · Firefox

Muneaki Nishimura · Published 2024-04-02 · Updated 2024-11-22 · CVE-2024-31393

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 124

Description The issue is related to insufficient input validation when dragging URL addresses into the address bar, allowing a remote attacker to bypass security restrictions and load arbitrary pages. This can be achieved by dragging Javascript URLs to the address bar, which could cause them to be loaded and bypass security protections.

Recommendations For Firefox for iOS versions prior to 124, update Firefox to a version 124 or later to resolve the issue. As a temporary workaround, consider avoiding dragging URLs into the address bar until the update is applied. Restrict access to suspicious links to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-04171

CVE-2024-31393

Affected Products

Firefox

References · 6

• https://osv.dev/vulnerability/CVE-2024-31393 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04171 · Security Note
• https://mozilla.org/security/advisories/mfsa2024-17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31393 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1879739 · Note
• https://twitter.com/oktsec/status/1779147979217076402 · Twitter Post