| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 4.2 | $0-$5k | 0.00 |
Summary
A vulnerability, which was classified as problematic, was found in Mozilla Focus up to 125 on iOS. Impacted is an unknown function of the component File Scheme Handler. The manipulation results in ui layer. This vulnerability is known as CVE-2024-5022. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.
Details
A vulnerability classified as problematic has been found in Mozilla Focus up to 125 on iOS. Affected is some unknown functionality of the component File Scheme Handler. The manipulation with an unknown input leads to a ui layer vulnerability. CWE is classifying the issue as CWE-1021. The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. This is going to have an impact on integrity. CVE summarizes:
The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affects Focus for iOS < 126.
The advisory is available at bugzilla.mozilla.org. This vulnerability is traded as CVE-2024-5022 since 05/16/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/29/2024).
Upgrading to version 126 eliminates this vulnerability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Product
Type
Vendor
Name
Version
License
Website
- Vendor: https://www.mozilla.org/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.3VulDB Meta Temp Score: 4.2
VulDB Base Score: 4.3
VulDB Temp Score: 4.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
CNA Base Score: 4.4
CNA Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Ui layerCWE: CWE-1021
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Focus 126
Timeline
05/16/2024 🔍05/17/2024 🔍
05/17/2024 🔍
03/29/2025 🔍
Sources
Vendor: mozilla.orgAdvisory: bugzilla.mozilla.org
Status: Confirmed
CVE: CVE-2024-5022 (🔍)
GCVE (CVE): GCVE-0-2024-5022
GCVE (VulDB): GCVE-100-265050
Entry
Created: 05/17/2024 23:29Updated: 03/29/2025 02:32
Changes: 05/17/2024 23:29 (55), 10/29/2024 04:24 (12), 03/29/2025 02:32 (3)
Complete: 🔍
Cache ID: 216::103
If you want to get best quality of vulnerability data, you may have to visit VulDB.
No comments yet. Languages: en.
Please log in to comment.