Firefox must be configured to allow only TLS 1.2 or above.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-251546	FFOX-00-000002	SV-251546r961869_rule	CCI-001453	high
Description
Use of versions prior to TLS 1.2 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.
STIG			Date
Mozilla Firefox Security Technical Implementation Guide			2025-11-25

Related Frameworks

1 mapping across 4 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-14.2Protection of Confidentiality / Integrity Using Encryption

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (31) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-17(2)Protection of Confidentiality and Integrity Using Encryption

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-3Access Enforcement

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(8)Access to Accounts — Replay Resistant

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-3Device Identification and Authentication

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-3(1)Cryptographic Bidirectional Authentication

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA STIG Benchmark (XCCDF)V3R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V3R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-5(1)Password-based Authentication

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+21 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.13

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
NIST SP 800-171 Rev 2, Appendix DRev 2 (Feb 2020, errata Jan 2021)equal to(normalised)

CCI1 mapping

CCI-001453

1.00

DISA STIG Benchmark (XCCDF)V6R7intersects(normalised)

Details

Check Text (C-251546r961869_chk)

Type "about:policies" in the browser window. If "SSLVersionMin" is not displayed under Policy Name or the Policy Value is not "tls1.2" or "tls1.3", this is a finding.

Fix Text (F-54935r820744_fix)

Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\ Policy Name: Minimum SSL version enabled Policy State: Enabled Policy Value: TLS 1.2 (or TLS 1.3) macOS "plist" file: Add the following: <key>SSLVersionMin</key> <string>tls1.2</string> (or <string>tls1.3</string>) Linux "policies.json" file: Add the following in the policies section: "SSLVersionMin": "tls1.2" or ("SSLVersionMin": "tls1.3")