Skip to main content

Cors Misconfiguration CVE-2025-13019

HIGH
Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)
2025-11-11 security@mozilla.org
Authentication Bypass Mozilla Cors Misconfiguration
8.1
CVSS 3.1 · Vendor: mozilla
View

Vulnerability Assessment

Weakness
CWE
CWE-942
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration CORS policy restriction
Impact

CVSS score of 8.1 (HIGH). Attack characteristics: network attack vector, low complexity, no privileges required, user interaction required. EPSS exploitation probability: 0.06%.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the high-severity affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

Same-origin policy bypass in the DOM: Workers component. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-942. Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. Affected products include: Mozilla Firefox.

Know when Cors Misconfiguration gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
SUSE HIGH
Red Hat 6.1 MEDIUM

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Apr 05, 2026 - 02:30 nvd
Patch available
CVE Published
Nov 11, 2025 - 16:15 nvd
HIGH 8.1

DescriptionCVE.org

Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.

Executive ViewAI

Why It Matters

CVE-2025-13019 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*

More in Cors Misconfiguration

View all
CVE-2026-61736 CRITICAL POC
9.3 Jul 15

Cross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
CVE-2024-41657 HIGH POC
8.8 Aug 20

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
CVE-2021-34435 HIGH POC
8.8 Sep 01

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
CVE-2026-84452 HIGH POC
8.6 Sep 02

Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` co
CVE-2025-30354 HIGH POC
8.7 Apr 01

Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
CVE-2024-41659 HIGH POC
8.1 Aug 20

memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
CVE-2026-70604 HIGH POC
7.4 Aug 05

Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
CVE-2026-15966 CRITICAL
9.8 Jul 23

Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
CVE-2025-61163 CRITICAL
9.8 Aug 26

Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
CVE-2024-37131 CRITICAL
9.8 Jun 13

SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
CVE-2022-26969 CRITICAL
9.8 Dec 26

In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
CVE-2022-31736 CRITICAL
9.8 Dec 22

A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical

Same weakness CWE-942 – Permissive Cross-domain Security Policy with Untrusted Domains

View all
CVE-2026-25478 HIGH POC
7.4

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.0-4.10 Container suse/sl-micro/6.1/base-os-container:2.2.0-4.9 Container suse/sl-micro/6.1/kvm-os-container:2.2.0-4.8 Container suse/sl-micro/6.1/rt-os-container:2.2.0-4.9 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:21120 ADVISORY https://access.redhat.com/errata/RHSA-2025:21121 ADVISORY https://access.redhat.com/errata/RHSA-2025:21280 ADVISORY https://access.redhat.com/errata/RHSA-2025:21281 ADVISORY https://access.redhat.com/errata/RHSA-2025:21841 ADVISORY https://access.redhat.com/errata/RHSA-2025:21842 ADVISORY https://access.redhat.com/errata/RHSA-2025:21843 ADVISORY https://access.redhat.com/errata/RHSA-2025:21844 ADVISORY https://access.redhat.com/errata/RHSA-2025:21881 ADVISORY https://access.redhat.com/errata/RHSA-2025:22363 ADVISORY https://access.redhat.com/errata/RHSA-2025:22367 ADVISORY https://access.redhat.com/errata/RHSA-2025:22368 ADVISORY https://access.redhat.com/errata/RHSA-2025:22369 ADVISORY https://access.redhat.com/errata/RHSA-2025:22371 ADVISORY https://access.redhat.com/errata/RHSA-2025:22372 ADVISORY https://access.redhat.com/errata/RHSA-2025:22373 ADVISORY https://access.redhat.com/errata/RHSA-2025:22374 ADVISORY https://access.redhat.com/errata/RHSA-2025:22375 ADVISORY https://access.redhat.com/errata/RHSA-2025:22449 ADVISORY https://access.redhat.com/errata/RHSA-2025:22450 ADVISORY https://access.redhat.com/errata/RHSA-2025:22451 ADVISORY https://access.redhat.com/errata/RHSA-2025:22791 ADVISORY https://access.redhat.com/errata/RHSA-2025:22792 ADVISORY https://access.redhat.com/errata/RHSA-2025:22882 ADVISORY https://access.redhat.com/errata/RHSA-2025:22883 ADVISORY https://vuldb.com/vuln/331926 ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-87/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-88/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21021/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4173/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4174/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4195/ REF https://bugzilla.mozilla.org/show_bug.cgi?id=1988412 REF https://www.mozilla.org/security/advisories/mfsa2025-90/ REF https://www.mozilla.org/security/advisories/mfsa2025-91/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy