by Kastro
Paper/Archive/CVE-2025-8031

CVE-2025-8031

Mozilla Firefox — Incorrect URL stripping in CSP reports

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.7.437 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory128.13CNA
Thunderbirdsee advisory128.13CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=1971719refmozilla.org/security/advisories/mfsa2025-56refmozilla.org/security/advisories/mfsa2025-58refmozilla.org/security/advisories/mfsa2025-59refmozilla.org/security/advisories/mfsa2025-61refmozilla.org/security/advisories/mfsa2025-62refmozilla.org/security/advisories/mfsa2025-63reflists.debian.org/debian-lts-announce/2025/07/msg00016.html