CVE-2024-9397

Published: Oct 1, 2024Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Affected (9)

Products: Mozilla: Firefox, Firefox Esr, Thunderbird

3 products

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	version < 131.0
Mozilla Firefox Esr	version < 128.3.0
Mozilla Thunderbird	version < 128.3
Mozilla Thunderbird	Version 129.0 beta2
Mozilla Thunderbird	Version 129.0 beta3
Mozilla Thunderbird	Version 129.0 beta4
Mozilla Thunderbird	Version 129.0 beta5
Mozilla Thunderbird	Version 129.0 beta6
Mozilla Thunderbird	Version 129.0 beta