Open Redirect in Mozilla Firefox
CVE-2024-0953
When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content. This vulnerability affects Firefox for iOS < 129.
Vulnerability class: Open Redirect
EPSS: 0.003 (22.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Mozilla Firefox
- Mozilla Firefox For Ios — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@mozilla.org (Exploit, Issue Tracking)
- security@mozilla.org
Frequently asked questions
- What is CVE-2024-0953?
- CVE-2024-0953 is a medium-severity vulnerability in Mozilla Firefox, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2024-02-05.
- How severe is CVE-2024-0953?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2024-0953 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.