Search for vulnerabilities
Vulnerability details: VCID-wkh7-h3uq-aaar
Vulnerability ID VCID-wkh7-h3uq-aaar
Aliases CVE-2024-4367
GHSA-wgrm-67xf-hhpq
Summary PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF ### Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. ### Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015 ### Workarounds Set the option `isEvalSupported` to `false`. ### References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-754 Improper Check for Unusual or Exceptional Conditions
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-4367.json
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.0956 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.10922 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.10922 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.11224 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.12421 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.12781 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.12781 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13314 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13314 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13314 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13314 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13314 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13314 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13314 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13314 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.13642 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.14112 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.14112 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.14484 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.14484 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.14484 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.14484 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.14484 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.14484 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.1598 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.1598 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.1598 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.1598 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.31904 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.31904 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.31904 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.31904 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.31904 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.35351 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.35351 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.49012 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.49012 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.49012 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.55398 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.55398 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.55398 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.55398 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.55398 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.55398 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.55398 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.55398 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.56867 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
epss 0.56867 https://api.first.org/data/v1/epss?cve=CVE-2024-4367
cvssv3.1 5.6 https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
cvssv3.1 5.6 https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
cvssv3.1 8.8 https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
generic_textual HIGH https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
ssvc Track* https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
ssvc Track* https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
cvssv3.1 8.8 https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js
generic_textual HIGH https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js
cvssv3.1 8.8 http://seclists.org/fulldisclosure/2024/Aug/30
generic_textual HIGH http://seclists.org/fulldisclosure/2024/Aug/30
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-wgrm-67xf-hhpq
cvssv3.1 8.8 https://github.com/gogs/gogs/issues/7928
generic_textual HIGH https://github.com/gogs/gogs/issues/7928
cvssv3.1 8.8 https://github.com/mozilla/pdf.js
cvssv3.1 8.8 https://github.com/mozilla/pdf.js
generic_textual HIGH https://github.com/mozilla/pdf.js
cvssv3.1 7.1 https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
cvssv3.1 8.8 https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
generic_textual HIGH https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
cvssv3.1 7.1 https://github.com/mozilla/pdf.js/pull/18015
cvssv3.1 8.8 https://github.com/mozilla/pdf.js/pull/18015
generic_textual HIGH https://github.com/mozilla/pdf.js/pull/18015
cvssv3.1 8.8 https://github.com/mozilla/pdf.js/releases/tag/v4.2.67
generic_textual HIGH https://github.com/mozilla/pdf.js/releases/tag/v4.2.67
cvssv3.1 7.1 https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
cvssv3.1 8.8 https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
cvssv3.1_qr HIGH https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
generic_textual HIGH https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
cvssv3.1 5.6 https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
cvssv3.1 5.6 https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
cvssv3.1 8.8 https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
ssvc Track* https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
ssvc Track* https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
cvssv3.1 5.6 https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
cvssv3.1 5.6 https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
cvssv3.1 8.8 https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
ssvc Track* https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
ssvc Track* https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2024-4367
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-4367
cvssv3.1 8.8 https://www.exploit-db.com/exploits/52273
generic_textual HIGH https://www.exploit-db.com/exploits/52273
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-21
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-22
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-23
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2024-21
generic_textual HIGH https://www.mozilla.org/security/advisories/mfsa2024-21
cvssv3.1 5.6 https://www.mozilla.org/security/advisories/mfsa2024-21/
cvssv3.1 5.6 https://www.mozilla.org/security/advisories/mfsa2024-21/
ssvc Track* https://www.mozilla.org/security/advisories/mfsa2024-21/
ssvc Track* https://www.mozilla.org/security/advisories/mfsa2024-21/
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2024-22
generic_textual HIGH https://www.mozilla.org/security/advisories/mfsa2024-22
cvssv3.1 5.6 https://www.mozilla.org/security/advisories/mfsa2024-22/
cvssv3.1 5.6 https://www.mozilla.org/security/advisories/mfsa2024-22/
ssvc Track* https://www.mozilla.org/security/advisories/mfsa2024-22/
ssvc Track* https://www.mozilla.org/security/advisories/mfsa2024-22/
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2024-23
generic_textual HIGH https://www.mozilla.org/security/advisories/mfsa2024-23
cvssv3.1 5.6 https://www.mozilla.org/security/advisories/mfsa2024-23/
cvssv3.1 5.6 https://www.mozilla.org/security/advisories/mfsa2024-23/
ssvc Track* https://www.mozilla.org/security/advisories/mfsa2024-23/
ssvc Track* https://www.mozilla.org/security/advisories/mfsa2024-23/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-4367.json
https://api.first.org/data/v1/epss?cve=CVE-2024-4367
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4367
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4767
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4768
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4769
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4770
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4777
http://seclists.org/fulldisclosure/2024/Aug/30
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/gogs/gogs/issues/7928
https://github.com/mozilla/pdf.js
https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
https://github.com/mozilla/pdf.js/pull/18015
https://github.com/mozilla/pdf.js/releases/tag/v4.2.67
https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
https://www.exploit-db.com/exploits/52273
https://www.mozilla.org/security/advisories/mfsa2024-21
https://www.mozilla.org/security/advisories/mfsa2024-21/
https://www.mozilla.org/security/advisories/mfsa2024-22
https://www.mozilla.org/security/advisories/mfsa2024-22/
https://www.mozilla.org/security/advisories/mfsa2024-23
https://www.mozilla.org/security/advisories/mfsa2024-23/
1074228 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1074228
2280382 https://bugzilla.redhat.com/show_bug.cgi?id=2280382
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:*:*:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:-:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:-:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision10:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision10:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision11:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision11:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision12:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision12:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision13:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision13:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision14:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision14:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision15:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision15:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision16:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision16:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision17:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision17:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision18:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision18:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision19:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision19:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision20:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision20:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision21:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision21:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision22:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision22:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision23:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision23:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision24:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision24:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision25:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision25:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision26:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision26:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision27:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision27:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision28:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision28:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision29:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision29:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision3:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision30:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision30:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision31:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision31:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision32:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision32:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision33:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision33:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision34:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision34:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision35:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision35:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision36:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision36:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision37:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision37:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision38:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision38:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision39:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision39:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision4:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision40:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision40:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision41:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision41:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision42:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision42:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision43:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision43:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision44:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision44:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision5:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision5:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision6:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision6:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision7:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision7:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision8:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision8:*:*:*:*:*:*
cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision9:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:open-xchange:open-xchange_appsuite_frontend:7.10.6:revision9:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2024-4367 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/52273.py
CVE-2024-4367 https://nvd.nist.gov/vuln/detail/CVE-2024-4367
CVE-2024-4367-ARBITRARY-JS-EXECUTION-IN-PDF-JS https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js
GHSA-wgrm-67xf-hhpq https://github.com/advisories/GHSA-wgrm-67xf-hhpq
mfsa2024-21 https://www.mozilla.org/en-US/security/advisories/mfsa2024-21
mfsa2024-22 https://www.mozilla.org/en-US/security/advisories/mfsa2024-22
mfsa2024-23 https://www.mozilla.org/en-US/security/advisories/mfsa2024-23
RHSA-2024:2881 https://access.redhat.com/errata/RHSA-2024:2881
RHSA-2024:2882 https://access.redhat.com/errata/RHSA-2024:2882
RHSA-2024:2883 https://access.redhat.com/errata/RHSA-2024:2883
RHSA-2024:2884 https://access.redhat.com/errata/RHSA-2024:2884
RHSA-2024:2885 https://access.redhat.com/errata/RHSA-2024:2885
RHSA-2024:2886 https://access.redhat.com/errata/RHSA-2024:2886
RHSA-2024:2887 https://access.redhat.com/errata/RHSA-2024:2887
RHSA-2024:2888 https://access.redhat.com/errata/RHSA-2024:2888
RHSA-2024:2903 https://access.redhat.com/errata/RHSA-2024:2903
RHSA-2024:2904 https://access.redhat.com/errata/RHSA-2024:2904
RHSA-2024:2905 https://access.redhat.com/errata/RHSA-2024:2905
RHSA-2024:2906 https://access.redhat.com/errata/RHSA-2024:2906
RHSA-2024:2911 https://access.redhat.com/errata/RHSA-2024:2911
RHSA-2024:2912 https://access.redhat.com/errata/RHSA-2024:2912
RHSA-2024:2913 https://access.redhat.com/errata/RHSA-2024:2913
RHSA-2024:3338 https://access.redhat.com/errata/RHSA-2024:3338
RHSA-2024:3783 https://access.redhat.com/errata/RHSA-2024:3783
RHSA-2024:3784 https://access.redhat.com/errata/RHSA-2024:3784
USN-6779-1 https://usn.ubuntu.com/6779-1/
USN-6782-1 https://usn.ubuntu.com/6782-1/
Data source Exploit-DB
Date added April 22, 2025
Description Firefox ESR 115.11 - PDF.js Arbitrary JavaScript execution
Ransomware campaign use Unknown
Source publication date April 22, 2025
Exploit type remote
Platform multiple
Source update date April 22, 2025
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-4367.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at http://seclists.org/fulldisclosure/2024/Aug/30
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/gogs/gogs/issues/7928
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/mozilla/pdf.js
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/mozilla/pdf.js
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/mozilla/pdf.js/pull/18015
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/mozilla/pdf.js/pull/18015
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/mozilla/pdf.js/releases/tag/v4.2.67
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-4367
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.exploit-db.com/exploits/52273
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2024-21
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2024-21/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2024-21/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-21/
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-21/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2024-22
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2024-22/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2024-22/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-22/
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-22/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2024-23
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2024-23/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2024-23/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-23/
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-26T04:55:26Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-23/
Exploit Prediction Scoring System (EPSS)
Percentile 0.11238
EPSS Score 0.00044
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-05-07T11:15:31.333742+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json 34.0.0rc4