CVE-2024-9397

MEDIUM 6.1

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Vendor	mozilla
Product	firefox
Ecosystems	Browser JavaScript
Industries	Technology
Published	Oct 1, 2024
Last Updated	Mar 2, 2026

Stay Ahead of the Next One

Get instant alerts for mozilla firefox

Be the first to know when new medium vulnerabilities affecting mozilla firefox are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Mozilla / Firefox

unspecified < 131

Mozilla / Firefox ESR

unspecified < 128.3

Mozilla / Thunderbird

unspecified < 128.3

Mozilla / Thunderbird

unspecified < 131

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bugzilla.mozilla.org: https://bugzilla.mozilla.org/show_bug.cgi?id=1916659 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2024-46/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2024-47/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2024-49/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2024-50/

Credits

Shaheen Fazim