CVE-2025-4090CWE-532

CVE-2025-4090

Medium · published April 29, 2025

CVSS v3.1

5.3

EPSS

Percentile

24.5

In the wild

Unconfirmed

What it is

A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00327 · 24.5th percentile
Weakness: CWE-532 · Insertion of Sensitive Information into Log File
Published: 2025-04-29T18:15Z

Affected products (2)

Product	Versions	Fixed in
mozilla/firefox	< 138.0	138.0
mozilla/thunderbird	< 138.0	138.0

References (3)

https://bugzilla.mozilla.org/show_bug.cgi?id=1929478 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-28/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-31/ · [email protected]

EPSS history

Timeline

29 APR 13:13Z
Leaked library paths in Thunderbird for Android
cvelistv5