CVE-2023-28161: High severity Mozilla Firefox vulnerability
If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 131.0-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 111
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-28161?
CVE-2023-28161 is a vulnerability in Mozilla Firefox that allows temporary permissions granted to a document loaded from a file: URL to persist in the tab for all other documents loaded from a file: URL.
What is the severity of CVE-2023-28161?
CVE-2023-28161 has a severity level of medium.
How does CVE-2023-28161 affect Mozilla Firefox?
CVE-2023-28161 affects Mozilla Firefox by allowing temporary one-time permissions, such as camera usage, granted to a document loaded from a file: URL to persist in the tab for other documents loaded from a file: URL, potentially leading to dangerous situations if the local files came from different sources.
How can I fix the CVE-2023-28161 vulnerability in Mozilla Firefox?
To fix the CVE-2023-28161 vulnerability in Mozilla Firefox, update to version 111 or higher.
Where can I find more information about CVE-2023-28161?
You can find more information about CVE-2023-28161 on the Mozilla Bugzilla and Mozilla Security Advisories websites.