CVE-2025-8031 | BDVDB-2026-287102 Detail
MozillaFirefox
Description#
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-276 Incorrect Default Permissions
References#
- https://bugzilla.mozilla.org/show_bug.cgi?id=1971719
- https://www.mozilla.org/security/advisories/mfsa2025-56/
- https://www.mozilla.org/security/advisories/mfsa2025-58/
- https://www.mozilla.org/security/advisories/mfsa2025-59/
- https://www.mozilla.org/security/advisories/mfsa2025-61/
- https://www.mozilla.org/security/advisories/mfsa2025-62/
- https://www.mozilla.org/security/advisories/mfsa2025-63/
- https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.