irefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in "strict-dynamic" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1.
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1909241 | Issue Tracking Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2024-33/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2024-34/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2024-35/ | Vendor Advisory |
Configuration 1 (hide)
|
29 Aug 2024, 17:35
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mozilla
Mozilla firefox Mozilla firefox Esr |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CPE | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
|
| CWE | CWE-79 | |
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1909241 - Issue Tracking, Permissions Required | |
| References | () https://www.mozilla.org/security/advisories/mfsa2024-33/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2024-34/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2024-35/ - Vendor Advisory |
06 Aug 2024, 16:30
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Published : 2024-08-06 13:15
Updated : 2025-03-25 17:16
NVD link : CVE-2024-7524
Mitre link : CVE-2024-7524
CVE.ORG link : CVE-2024-7524
JSON object : View
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')