CVE-2024-5691

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 127
Mozilla	Firefox ESR	>= unspecified, < 115.12
Mozilla	Thunderbird	>= unspecified, < 115.12

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1888695Issue Tracking, Permissions Required
https://lists.debian.org/debian-lts-announce/2024/06/msg00000.htmlMailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00010.htmlMailing List
https://www.mozilla.org/security/advisories/mfsa2024-25/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-26/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-28/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1888695Issue Tracking, Permissions Required
https://lists.debian.org/debian-lts-announce/2024/06/msg00000.htmlMailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00010.htmlMailing List
https://www.mozilla.org/security/advisories/mfsa2024-25/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-26/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-28/Vendor Advisory

Timeline

Published: Jun 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-569145.7D-Link DSL-3782 v1.01 is vulnerable to Buffer Overflow in /New_GUI/ParentalControl.asp.CVE-2024-569156.5Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.CVE-2024-569166.1In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current v CVE-2024-569177.1Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode.CVE-2024-569186.1In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to CVE-2024-56926.5On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed ext CVE-2024-569217.5An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect err CVE-2024-569235.4Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6 CVE-2024-569247.3A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary J CVE-2024-56936.1Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of sa CVE-2024-569385.4LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.CVE-2024-569395.4LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.