2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThan":"126","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security@mozilla.org"},{"affectedData":[{"cpes":["cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"firefox","vendor":"mozilla","versions":[{"lessThan":"126","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","matchCriteriaId":"706B671C-BEF5-488D-BCEF-3A5342A4DD1C","versionEndExcluding":"126.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. \n*This issue only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126."},{"lang":"es","value":"Los manifiestos de las aplicaciones web se almacenaban mediante un hash MD5 inseguro que permitía que una colisión de hash sobrescribiera el manifiesto de otra aplicación. Esto podría haberse aprovechado para ejecutar código arbitrario en el contexto de otra aplicación. *Este problema sólo afecta a Firefox para Android. Otras versiones de Firefox no se ven afectadas.* Esta vulnerabilidad afecta a Firefox < 126."}],"id":"CVE-2024-4765","lastModified":"2026-06-17T08:02:51.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-4765","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-08-08T18:46:51.056911Z","version":"2.0.3"}}]},"published":"2024-05-14T18:15:13.133","references":[{"source":"security@mozilla.org","tags":["Issue Tracking"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1871109"},{"source":"security@mozilla.org","tags":["Vendor Advisory"],"url":"https://www.mozilla.org/security/advisories/mfsa2024-21/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1871109"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.mozilla.org/security/advisories/mfsa2024-21/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-327"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
|