CVE-2024-2609: debian debian_linux
CVSS: 6.1v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2024-2609DEBIAN-CVE-2024-2609CGA-54fq-r39r-vmq8CGA-6x77-fjr9-p7q3
Published 19-03-2024Last modified 14-03-2025
Vulnerability summary
CVE-2024-2609 is a medium (CVSS 6.1) vulnerability in debian debian_linux. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)EPSS score
0.60%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 34 · Related 11DLA-3790-1DLA-3791-1DSA-5663-1DSA-5670-1MGASA-2024-0151MGASA-2024-0153OPENSUSE-SU-2024:13795-1OPENSUSE-SU-2024:13884-1OPENSUSE-SU-2024:14572-1RHSA-2024:1904RHSA-2024:1905RHSA-2024:1906RHSA-2024:1907RHSA-2024:1908RHSA-2024:1909RHSA-2024:1910RHSA-2024:1911RHSA-2024:1912RHSA-2024:1934RHSA-2024:1935RHSA-2024:1936RHSA-2024:1937RHSA-2024:1938RHSA-2024:1939RHSA-2024:1940RHSA-2024:1941RHSA-2024:1982SUSE-SU-2024:1319-1SUSE-SU-2024:1350-1SUSE-SU-2024:1437-1SUSE-SU-2024:1676-1SUSE-SU-2024:1770-1USN-6703-1USN-6750-1CGA-PX7Q-JGR5-H593
Timeline
- 19-03-2024PublishedVulnerability first disclosed.
- 14-03-2025Last modifiedVulnerability information updated.
Description
The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.60% on 19-09-2026
19-09-202619-10-2026
EPSS score0.60%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.mozilla.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ubuntu8 products
- firefox< 124.0+build1-0ubuntu0.20.04.1
- mozjs102All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
Debian3 products
- firefox-esr< 115.10.0esr-1~deb12u1 | < 115.10.0esr-1
- thunderbird< 1:115.10.1-1~deb12u1 | < 1:115.10.1-1
- debian_linuxEOL10.0
Mozilla3 products
- firefox≥ unspecified, < 124 | < 115.10.0 | < 124.0
- firefox_esr≥ unspecified, < 115.10
- thunderbird≥ unspecified, < 115.10 | < 115.10.0
Chainguard1 product
- firefox-esr< 124-r0
4 vendors · 15 products
