CVE-2023-28163
First published: Tue Mar 14 2023(Updated: )
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Thunderbird | <102.9 | 102.9 |
| Mozilla Firefox | <111.0 | |
| Mozilla Firefox ESR | <102.9 | |
| Mozilla Thunderbird | <102.9 | |
| <111 | 111 | |
| <102.9 | 102.9 | |
| <102.9 | 102.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1817768
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-09/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-10/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/#CVE-2023-28164
- https://www.mozilla.org/security/advisories/mfsa2023-09/
- https://www.mozilla.org/security/advisories/mfsa2023-10/
- https://www.mozilla.org/security/advisories/mfsa2023-11/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2023-28163?
CVE-2023-28163 is a vulnerability that affects Firefox on Windows when downloading files through the Save As dialog.
Which software versions are affected by CVE-2023-28163?
Firefox versions up to exclusive version 111, Firefox ESR versions up to exclusive version 102.9, and Thunderbird up to exclusive version 102.9 are affected by CVE-2023-28163.
What is the severity of CVE-2023-28163?
CVE-2023-28163 has a medium severity rating with a CVSS score of 4.
How does CVE-2023-28163 impact Firefox on Windows?
CVE-2023-28163 allows environment variable names in suggested filenames to be resolved in the context of the current user, potentially leading to information disclosure.
How can I fix CVE-2023-28163?
To fix CVE-2023-28163, update your Firefox, Firefox ESR, or Thunderbird software to the latest version available.
- collector/nvd-latest
- collector/mozilla-advisory
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- source/Mozilla
- agent/software-canonical-lookup
- agent/description
- agent/severity
- agent/event
- agent/author
- agent/tags
- agent/references
- agent/software-canonical-lookup-request
- vendor/mozilla
- canonical/mozilla thunderbird
- canonical/mozilla firefox
- canonical/mozilla firefox esr