CVE-2024-5693 : Offscreen Canvas did not properly track cross-origin tainting, which could be us

Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

Published 2024-06-11 13:15:51

Updated 2025-03-27 20:02:25

Source Mozilla Corporation

View at NVD, CVE.org

Products affected by CVE-2024-5693

Mozilla » Firefox
Versions before (<) 127.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » ESR Edition
Versions before (<) 115.12
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
Matching versions
Mozilla » Thunderbird
Versions before (<) 115.12
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2024-5693

EPSS FAQ

0.33%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2024-5693

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-07-03
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	N/A	N/A	RedHat-CVE-2024-5693	2024-06-12
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2024-5693

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

References for CVE-2024-5693

https://www.mozilla.org/security/advisories/mfsa2024-26/

Security Vulnerabilities fixed in Firefox ESR 115.12 — Mozilla
Vendor Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html

[SECURITY] [DLA 3825-1] firefox-esr security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html

[SECURITY] [DLA 3836-1] thunderbird security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.mozilla.org/security/advisories/mfsa2024-28/

Security Vulnerabilities fixed in Firefox ESR 115.12 — Mozilla
Vendor Advisory

CVEs referencing this url
https://bugzilla.mozilla.org/show_bug.cgi?id=1891319

Access Denied
Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-25/

Security Vulnerabilities fixed in Firefox 127 — Mozilla
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2024-5693

Products affected by CVE-2024-5693

Exploit prediction scoring system (EPSS) score for CVE-2024-5693

CVSS scores for CVE-2024-5693

CWE ids for CVE-2024-5693

References for CVE-2024-5693