CVE-2024-5698: mozilla firefox
CVSS: 6.1v3.1MediumModified
AliasesUBUNTU-CVE-2024-5698CGA-4859-5g98-f38hCGA-5fhf-x5xv-vh32CGA-86mv-vph6-3h5hCGA-j27p-c36j-xh2x
Published 11-06-2024Last modified 14-03-2025
Vulnerability summary
CVE-2024-5698 is a medium (CVSS 6.1) vulnerability in mozilla firefox. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.9% of scored vulnerabilities.
CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
0.38%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 5Timeline
- 11-06-2024PublishedVulnerability first disclosed.
- 14-03-2025Last modifiedVulnerability information updated.
Description
By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 127.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSources5 sources · 5.4–6.1
- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 21-09-2026
21-09-202621-10-2026
EPSS score0.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1021Improper Restriction of Rendered UI Layers or FramesThe web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
- CWE-451User Interface (UI) Misrepresentation of Critical InformationThe user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
Affected systems
Ubuntu7 products
- firefox< 127.0.2+build1-0ubuntu0.20.04.1
- mozjs102All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
Chainguard2 products
- firefox< 127.0.2-r0
- firefox-esr< 127-r0
Mozilla1 product
- firefox≥ unspecified, < 127 | < 127
Wolfi1 product
- firefox< 127.0.2-r0
4 vendors · 11 products