How severe is CVE-2023-34414?

This vulnerability has a severity rating of LOW with a CVSS score of 3.1 out of 10.

What type of vulnerability is CVE-2023-34414?

This is classified as CWE-295, which is a common weakness in software security.

CVE-2023-34414 - LOW Severity | CVSS 3.1

Vulnerability Description

The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.

Related Vulnerabilities

CVE-2009-3552

LOW

CVSS:3.1(Low)

In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML...

CWE-2952009

CVE-2020-4340

LOW

CVSS:3.1(Low)

IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180.

CWE-2952020

CVE-2025-26478

LOW

CVSS:3.1(Low)

Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, lead...

CWE-2952025

CVE-2019-1552

LOW

CVSS:3.3(Low)

OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDI...

CWE-2952019

CVE-2019-8642

LOW

CVSS:3.3(Low)

An issue existed in the handling of S-MIME certificates. This issue was addressed with improved validation of S-MIME certificates. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002...

CWE-2952019

CVE-2022-23649

LOW

CVSS:3.3(Low)

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exist...

CWE-2952022