CVE-2025-23109CWE-346

CVE-2025-23109

Medium · published January 11, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for iOS 134.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00186 · 7.8th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2025-01-11T09:15Z
Affected products (1)
ProductVersionsFixed in
mozilla/firefox< 134.0134.0
References (2)
https://bugzilla.mozilla.org/show_bug.cgi?id=1419275 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-06/ · [email protected]
EPSS history
Timeline
  • 11 JAN 03:36Z
    Address bar spoofing on iOS using long hostnames
    cvelistv5