CVE-2024-4772

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-338

Affected software

VendorProductVersions
MozillaFirefox>= unspecified, < 126
mozillafirefox< 126

References

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-477205.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for set_output_gamma in dcn30_set_outpuCVE-2024-477217.1In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAMCVE-2024-477237.1In the Linux kernel, the following vulnerability has been resolved: jfs: fix out-of-bounds in dbNextAG() and diAlloc() In dbNextAG() , theCVE-2024-477245.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: use work queue to process beacon tx event Commit 3a415daCVE-2024-477266.5In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait dio completion It should wait all existing dio writeCVE-2024-477277.8In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix "in-kernel MMIO" check TDX only supports kernel-initiatedCVE-2024-477285.5In the Linux kernel, the following vulnerability has been resolved: bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error For all nCVE-2024-477295.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices UsCVE-2024-47737.5When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been useCVE-2024-477307.8In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject error before stopping queue The master oCVE-2024-477315.5In the Linux kernel, the following vulnerability has been resolved: drivers/perf: Fix ali_drw_pmu driver interrupt status clearing The aliCVE-2024-477325.5In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix potential use after free bug The free_device_compres
CVE-2024-4772: Medium severity, CVSS 5.9 | Vulnix