CVE-2025-8031_CVE-2025-8031

9.8 / 10

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

Basic Information

ID CVE-2025-8031

Source mozilla

Published Jul 22, 2025 at 20:49

Modified Jul 23, 2025 at 14:00

Affected Product

Vendor Mozilla

Product Firefox

Version unspecified

Affected Versions Mozilla Firefox unspecified
Mozilla Firefox ESR unspecified
Mozilla Firefox ESR unspecified
Mozilla Thunderbird unspecified
Mozilla Thunderbird unspecified
Mozilla Thunderbird unspecified

CWE Classification

CWE-276

References

{
    "lastseen": "",
    "description": "The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.",
    "published": "2025-07-22T20:49:26.243Z",
    "modified": "2025-07-23T14:00:29.698Z",
    "type": "cve",
    "title": "CVE-2025-8031",
    "source": "mozilla",
    "references": "https://bugzilla.mozilla.org/show_bug.cgi?id=1971719\nhttps://www.mozilla.org/security/advisories/mfsa2025-56/\nhttps://www.mozilla.org/security/advisories/mfsa2025-58/\nhttps://www.mozilla.org/security/advisories/mfsa2025-59/\nhttps://www.mozilla.org/security/advisories/mfsa2025-61/\nhttps://www.mozilla.org/security/advisories/mfsa2025-62/\nhttps://www.mozilla.org/security/advisories/mfsa2025-63/",
    "id": "CVE-2025-8031",
    "bulletinFamily": "",
    "cwe": [
        "CWE-276"
    ],
    "cvelist": null,
    "sourceData": "Mozilla Firefox unspecified\nMozilla Firefox ESR unspecified\nMozilla Firefox ESR unspecified\nMozilla Thunderbird unspecified\nMozilla Thunderbird unspecified\nMozilla Thunderbird unspecified",
    "sourceHref": "",
    "cvss": {
        "score": 9.8,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Firefox",
    "version": "unspecified",
    "vendor": "Mozilla",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}