CVE-2023-34414: mozilla firefox Improper Certificate Validation
Vulnerability summary
CVE-2023-34414 is a low (CVSS 3.1) Improper Certificate Validation vulnerability in mozilla firefox. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 58.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 31 · Related 9Timeline
- 19-06-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.90%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.90% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla3 products
- firefox≥ unspecified, < 114 | < 114.0
- firefox_esr≥ unspecified, < 102.12 | < 102.12
- thunderbird≥ unspecified, < 102.12 | < 102.12
Debian2 products
- firefox-esr< 102.12.0esr-1~deb12u1 | < 102.12.0esr-1
- thunderbird< 1:102.12.0-1~deb12u1 | < 1:102.12.0-1
Ubuntu2 products
- firefox< 114.0+build3-0ubuntu0.20.04.1
- thunderbird< 1:102.13.0+build1-0ubuntu0.20.04.1 | < 1:102.13.0+build1-0ubuntu0.22.04.1
3 vendors · 7 products
References
13 links- bugzilla.mozilla.org/show_bug.cgi?id=1695986Permissions Required
- www.mozilla.org/security/advisories/mfsa2023-19/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2023-20/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2023-21/Vendor Advisory
