Authentication bypass by spoofing in Mozilla Firefox
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-290.
Summary
The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133 and Thunderbird < 133.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mozilla | Firefox | before 133 | 133 | Patch available | CNA |
| Mozilla | Thunderbird | before 133 | 133 | Patch available | CNA |
Remediation
- Fix · CNA Firefox (Mozilla) Fixed in 133
- Fix · CNA Thunderbird (Mozilla) Fixed in 133
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Mozilla Firefox 133
17 records Highest priority Priority MEDIUM 7 MEDIUM, 10 LOW
Other records, highest priority first
- TI-2024-10850 Double free in Mozilla FirefoxPriority MEDIUM 51
- TI-2024-10844 A flaw in handling fullscreen transitions may have inadvertently caused the application…Priority MEDIUM 50
- TI-2024-10839 The executable file warning was not presented when downloading .library-ms files.Priority MEDIUM 50
- Release ·
Mozilla Thunderbird 133
16 records Highest priority Priority MEDIUM 7 MEDIUM, 9 LOW
Other records, highest priority first
- TI-2024-10850 Double free in Mozilla FirefoxPriority MEDIUM 51
- TI-2024-10844 A flaw in handling fullscreen transitions may have inadvertently caused the application…Priority MEDIUM 50
- TI-2024-10839 The executable file warning was not presented when downloading .library-ms files.Priority MEDIUM 50
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | — |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-11701
- 2026-10-03 Alias added: GHSA-p9vw-xw86-3f2w
References
More Mozilla Firefox vulnerabilities
- TI-2024-08981 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.8
- TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
- TI-2019-08769 Improper input validation in Mozilla Firefox ESR KEVCVSS 3.1CRITICAL 10.0
- TI-2010-03577 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
- TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2024-11701 · CVE Program
- CVE-2024-11701 · NVD
- FIRST EPSS
- GHSA-p9vw-xw86-3f2w · GitHub Advisory Database · CC BY 4.0
- CVE-2024-11701 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences