CVE-2025-0237CWE-863broken-access-control

CVE-2025-0237

Medium · published January 7, 2025

CVSS v3.1

5.4

EPSS

Percentile

47.9

In the wild

Unconfirmed

What it is

The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00598 · 47.9th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2025-01-07T21:15Z

Affected products (4)

Product	Versions	Fixed in
mozilla/firefox	< 128.6.0	128.6.0
mozilla/firefox	< 134.0	134.0
mozilla/thunderbird	< 128.6.0	128.6.0
mozilla/thunderbird	≥ 129.0, < 134.0	134.0

References (6)

https://www.mozilla.org/security/advisories/mfsa2025-01/ · [email protected]https://bugzilla.mozilla.org/show_bug.cgi?id=1915257 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-02/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-04/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-05/ · [email protected]https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

07 JAN 16:07Z
WebChannel APIs susceptible to confused deputy attack
cvelistv5