Search for vulnerabilities
Vulnerability details: VCID-qphu-a5ck-a7dw
Vulnerability ID VCID-qphu-a5ck-a7dw
Aliases CVE-2024-1549
Summary If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-1021 Improper Restriction of Rendered UI Layers or Frames
System Score Found at
cvssv3 6.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-1549.json
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00368 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00368 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00368 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00368 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00368 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00375 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00375 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00375 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00375 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00375 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00424 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00424 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00436 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00436 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
epss 0.00436 https://api.first.org/data/v1/epss?cve=CVE-2024-1549
cvssv3.1 6.1 https://bugzilla.mozilla.org/show_bug.cgi?id=1833814
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1833814
cvssv3.1 6.1 https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
cvssv3.1 6.1 https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-05
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-06
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-07
cvssv3.1 6.1 https://www.mozilla.org/security/advisories/mfsa2024-05/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-05/
cvssv3.1 6.1 https://www.mozilla.org/security/advisories/mfsa2024-06/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-06/
cvssv3.1 6.1 https://www.mozilla.org/security/advisories/mfsa2024-07/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-07/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-1549.json
https://api.first.org/data/v1/epss?cve=CVE-2024-1549
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1546
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1547
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1548
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1549
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1550
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1551
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1552
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1553
2265352 https://bugzilla.redhat.com/show_bug.cgi?id=2265352
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2024-1549 https://nvd.nist.gov/vuln/detail/CVE-2024-1549
mfsa2024-05 https://www.mozilla.org/en-US/security/advisories/mfsa2024-05
mfsa2024-05 https://www.mozilla.org/security/advisories/mfsa2024-05/
mfsa2024-06 https://www.mozilla.org/en-US/security/advisories/mfsa2024-06
mfsa2024-06 https://www.mozilla.org/security/advisories/mfsa2024-06/
mfsa2024-07 https://www.mozilla.org/en-US/security/advisories/mfsa2024-07
mfsa2024-07 https://www.mozilla.org/security/advisories/mfsa2024-07/
msg00000.html https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
msg00001.html https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
RHSA-2024:0952 https://access.redhat.com/errata/RHSA-2024:0952
RHSA-2024:0955 https://access.redhat.com/errata/RHSA-2024:0955
RHSA-2024:0957 https://access.redhat.com/errata/RHSA-2024:0957
RHSA-2024:0958 https://access.redhat.com/errata/RHSA-2024:0958
RHSA-2024:0959 https://access.redhat.com/errata/RHSA-2024:0959
RHSA-2024:0960 https://access.redhat.com/errata/RHSA-2024:0960
RHSA-2024:0961 https://access.redhat.com/errata/RHSA-2024:0961
RHSA-2024:0962 https://access.redhat.com/errata/RHSA-2024:0962
RHSA-2024:0963 https://access.redhat.com/errata/RHSA-2024:0963
RHSA-2024:0964 https://access.redhat.com/errata/RHSA-2024:0964
RHSA-2024:0968 https://access.redhat.com/errata/RHSA-2024:0968
RHSA-2024:0969 https://access.redhat.com/errata/RHSA-2024:0969
RHSA-2024:0970 https://access.redhat.com/errata/RHSA-2024:0970
RHSA-2024:0971 https://access.redhat.com/errata/RHSA-2024:0971
RHSA-2024:0972 https://access.redhat.com/errata/RHSA-2024:0972
RHSA-2024:0976 https://access.redhat.com/errata/RHSA-2024:0976
RHSA-2024:0983 https://access.redhat.com/errata/RHSA-2024:0983
RHSA-2024:0984 https://access.redhat.com/errata/RHSA-2024:0984
show_bug.cgi?id=1833814 https://bugzilla.mozilla.org/show_bug.cgi?id=1833814
USN-6649-1 https://usn.ubuntu.com/6649-1/
USN-6669-1 https://usn.ubuntu.com/6669-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-1549.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1833814
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T15:25:48Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1833814
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T15:25:48Z/ Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T15:25:48Z/ Found at https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2024-05/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T15:25:48Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-05/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2024-06/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T15:25:48Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-06/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2024-07/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T15:25:48Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-07/
Exploit Prediction Scoring System (EPSS)
Percentile 0.5664
EPSS Score 0.00348
Published At Aug. 14, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:09:05.495696+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2024/mfsa2024-07.yml 37.0.0