medium5.3
CVE-2024-6612
CSP violations generated links in the console tab of the developer tools, pointing to the violating resource.
Impact
CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 128.0 |
| Mozilla | Thunderbird | before 128.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.mozilla.org/show_bug.cgi?id=1880374
- https://www.mozilla.org/security/advisories/mfsa2024-29/
- https://www.mozilla.org/security/advisories/mfsa2024-32/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1880374
- https://www.mozilla.org/security/advisories/mfsa2024-29/
- https://www.mozilla.org/security/advisories/mfsa2024-32/