{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-29T13:34:29.128","vulnerabilities":[{"cve":{"id":"CVE-2024-7524","sourceIdentifier":"security@mozilla.org","published":"2024-08-06T13:15:57.357","lastModified":"2026-06-17T08:20:22.627","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection.  On a site protected by Content Security Policy in \"strict-dynamic\" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1."},{"lang":"es","value":"Firefox agrega ajustes de compatibilidad web en lugar de algunos scripts de seguimiento bloqueados por la Protección de seguimiento mejorada. En un sitio protegido por la Política de seguridad de contenido en modo \"dinámico estricto\", un atacante capaz de inyectar un elemento HTML podría haber utilizado un ataque DOM Clobbering en algunas de las correcciones y lograr XSS, evitando la protección dinámica estricta del CSP. Esta vulnerabilidad afecta a Firefox &lt; 129, Firefox ESR &lt; 115.14 y Firefox ESR &lt; 128.1."}],"affected":[{"source":"security@mozilla.org","affectedData":[{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","lessThan":"129","versionType":"custom","status":"affected"}]},{"vendor":"Mozilla","product":"Firefox ESR","versions":[{"version":"unspecified","lessThan":"115.14","versionType":"custom","status":"affected"}]},{"vendor":"Mozilla","product":"Firefox ESR","versions":[{"version":"unspecified","lessThan":"128.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-08-06T20:09:21.211985Z","id":"CVE-2024-7524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndExcluding":"129.0","matchCriteriaId":"12C9ABF7-3B44-4C24-B152-488DCF9E2D39"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*","versionEndExcluding":"115.14","matchCriteriaId":"77E36842-1F83-4A47-94D2-5D0A9825D3C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*","versionStartIncluding":"116.0","versionEndExcluding":"128.1","matchCriteriaId":"38D2AF1C-E314-45EE-A2A9-7B44DA2A4ACF"}]}]}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1909241","source":"security@mozilla.org","tags":["Issue Tracking","Permissions Required"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-33/","source":"security@mozilla.org","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-34/","source":"security@mozilla.org","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-35/","source":"security@mozilla.org","tags":["Vendor Advisory"]}]}}]}