Mozilla Firefox up to 122 API fetch data authenticity

Summaryinfo

A vulnerability identified as problematic has been detected in Mozilla Firefox up to 122. This affects the function fetch of the component API. The manipulation leads to an unknown weakness. This vulnerability is uniquely identified as CVE-2024-1554. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Mozilla Firefox up to 122 (Web Browser). This issue affects the function fetch of the component API. Using CWE to declare the problem leads to CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. Impacted is integrity. The summary by CVE is:

The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain. Under the correct circumstances, an attacker may have been able to poison the local browser cache by priming it with a `fetch()` response controlled by the additional headers. Upon navigation to the same URL, the user would see the cached response instead of the expected response. This vulnerability affects Firefox < 123.

The weakness was disclosed 02/20/2024. It is possible to read the advisory at mozilla.org. The identification of this vulnerability is CVE-2024-1554 since 02/15/2024. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/12/2025).

The vulnerability scanner Nessus provides a plugin with the ID 248418 (Linux Distros Unpatched Vulnerability : CVE-2024-1554), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 123 eliminates this vulnerability. The upgrade is hosted for download at mozilla.org.

The vulnerability is also documented in the vulnerability database at Tenable (248418). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 122

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion