CVE-2024-4769
Mozilla Firefox ≤ 115.11.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-4769 is a medium-severity Insufficient Type Distinction (CWE-351) vulnerability in Mozilla Firefox. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-16 (Security and Privacy Attributes) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44363
Vulnerability Data
When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird <…
more
115.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.3
Mitigating Controls (NIST 800-53 r5) AI
Input validation can reject or correctly classify data whose type is ambiguous or incorrect, stopping the weakness at entry points.
Associating security and privacy attributes with objects supplies the mechanism needed to distinguish element types and enforce handling rules.
Information flow enforcement requires explicit rules that distinguish information types or categories before permitting transfer.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent type-distinction flaws during development while the control addresses the full lifecycle.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect type confusion vulnerabilities before deployment.
Secure development lifecycle practices can include type-safe design and validation to reduce type confusion.
Application security requirements can mandate explicit type handling and validation rules.
Secure architecture principles encourage strong typing and clear type boundaries in system design.
Secure coding standards directly address proper type distinction and validation to prevent type-related flaws.