Search for vulnerabilities
Vulnerability details: VCID-9qgx-e2kh-uyew
Vulnerability ID VCID-9qgx-e2kh-uyew
Aliases CVE-2025-8031
Summary The username:password part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-276 Incorrect Default Permissions
System Score Found at
cvssv3 6.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-8031.json
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2025-8031
cvssv3.1 9.8 https://bugzilla.mozilla.org/show_bug.cgi?id=1971719
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1971719
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-56
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-58
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-59
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-61
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-62
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-63
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2025-56/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-56/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2025-58/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-58/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2025-59/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-59/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2025-61/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-61/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2025-62/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-62/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2025-63/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-63/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-8031.json
https://api.first.org/data/v1/epss?cve=CVE-2025-8031
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8031
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2382704 https://bugzilla.redhat.com/show_bug.cgi?id=2382704
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
CVE-2025-8031 https://nvd.nist.gov/vuln/detail/CVE-2025-8031
mfsa2025-56 https://www.mozilla.org/en-US/security/advisories/mfsa2025-56
mfsa2025-56 https://www.mozilla.org/security/advisories/mfsa2025-56/
mfsa2025-58 https://www.mozilla.org/en-US/security/advisories/mfsa2025-58
mfsa2025-58 https://www.mozilla.org/security/advisories/mfsa2025-58/
mfsa2025-59 https://www.mozilla.org/en-US/security/advisories/mfsa2025-59
mfsa2025-59 https://www.mozilla.org/security/advisories/mfsa2025-59/
mfsa2025-61 https://www.mozilla.org/en-US/security/advisories/mfsa2025-61
mfsa2025-61 https://www.mozilla.org/security/advisories/mfsa2025-61/
mfsa2025-62 https://www.mozilla.org/en-US/security/advisories/mfsa2025-62
mfsa2025-62 https://www.mozilla.org/security/advisories/mfsa2025-62/
mfsa2025-63 https://www.mozilla.org/en-US/security/advisories/mfsa2025-63
mfsa2025-63 https://www.mozilla.org/security/advisories/mfsa2025-63/
RHSA-2025:11747 https://access.redhat.com/errata/RHSA-2025:11747
RHSA-2025:11748 https://access.redhat.com/errata/RHSA-2025:11748
RHSA-2025:11797 https://access.redhat.com/errata/RHSA-2025:11797
RHSA-2025:12044 https://access.redhat.com/errata/RHSA-2025:12044
RHSA-2025:12045 https://access.redhat.com/errata/RHSA-2025:12045
RHSA-2025:12046 https://access.redhat.com/errata/RHSA-2025:12046
RHSA-2025:12187 https://access.redhat.com/errata/RHSA-2025:12187
RHSA-2025:12188 https://access.redhat.com/errata/RHSA-2025:12188
RHSA-2025:12278 https://access.redhat.com/errata/RHSA-2025:12278
RHSA-2025:12302 https://access.redhat.com/errata/RHSA-2025:12302
RHSA-2025:12353 https://access.redhat.com/errata/RHSA-2025:12353
RHSA-2025:12360 https://access.redhat.com/errata/RHSA-2025:12360
RHSA-2025:12361 https://access.redhat.com/errata/RHSA-2025:12361
RHSA-2025:13645 https://access.redhat.com/errata/RHSA-2025:13645
RHSA-2025:13646 https://access.redhat.com/errata/RHSA-2025:13646
RHSA-2025:13647 https://access.redhat.com/errata/RHSA-2025:13647
RHSA-2025:13648 https://access.redhat.com/errata/RHSA-2025:13648
RHSA-2025:13649 https://access.redhat.com/errata/RHSA-2025:13649
RHSA-2025:13650 https://access.redhat.com/errata/RHSA-2025:13650
RHSA-2025:13651 https://access.redhat.com/errata/RHSA-2025:13651
RHSA-2025:13676 https://access.redhat.com/errata/RHSA-2025:13676
show_bug.cgi?id=1971719 https://bugzilla.mozilla.org/show_bug.cgi?id=1971719
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-8031.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1971719
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:56:53Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1971719
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-56/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:56:53Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-56/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-58/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:56:53Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-58/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-59/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:56:53Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-59/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-61/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:56:53Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-61/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-62/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:56:53Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-62/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-63/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-07-23T13:56:53Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-63/
Exploit Prediction Scoring System (EPSS)
Percentile 0.29895
EPSS Score 0.00108
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:09:24.190282+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2025/mfsa2025-62.yml 37.0.0