Beveiligingsadvies

CVE-2024-9393

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2024-10-01 15:13:19

Laatst bijgewerkt 2025-11-03 22:33:27

Toegewezen door mozilla

CVSS-score 7.5

Status PUBLISHED

Beschrijving

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

← Alle CVE's bekijken Bekijk op cve.org ↗