CVE-2024-5690 : By monitoring the time certain operations take, an attacker could have guessed w

By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

Published 2024-06-11 13:15:51

Updated 2025-03-26 14:15:32

Source Mozilla Corporation

View at NVD, CVE.org

Products affected by CVE-2024-5690

Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox
Versions before (<) 127.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Matching versions
Mozilla » Thunderbird
Versions before (<) 115.12
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox Esr
Versions before (<) 115.12
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2024-5690

EPSS FAQ

1.27%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 78 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2024-5690

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	2.8	1.4	134c704f-9b21-4f2e-91b3-4a467353bcc0	2025-03-26
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	2.8	1.4	NIST	2024-08-09
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	N/A	N/A	RedHat-CVE-2024-5690	2024-06-12
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2024-5690

CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2024-5690

https://bugzilla.mozilla.org/show_bug.cgi?id=1883693

Access Denied
Issue Tracking;Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-26/

Security Vulnerabilities fixed in Firefox ESR 115.12 — Mozilla
Vendor Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html

[SECURITY] [DLA 3825-1] firefox-esr security update
Mailing List

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html

[SECURITY] [DLA 3836-1] thunderbird security update
Mailing List

CVEs referencing this url
https://www.mozilla.org/security/advisories/mfsa2024-28/

Security Vulnerabilities fixed in Firefox ESR 115.12 — Mozilla
Vendor Advisory

CVEs referencing this url
https://www.mozilla.org/security/advisories/mfsa2024-25/

Security Vulnerabilities fixed in Firefox 127 — Mozilla
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2024-5690

Products affected by CVE-2024-5690

Exploit prediction scoring system (EPSS) score for CVE-2024-5690

CVSS scores for CVE-2024-5690

CWE ids for CVE-2024-5690

References for CVE-2024-5690