CVE-2023-37206: Medium severity Mozilla Firefox vulnerability

Q: What is the vulnerability ID of this security issue?

The vulnerability ID is CVE-2023-37206.

Q: What software is affected by this security vulnerability?

Firefox versions prior to 115 are affected.

Q: What is the severity of CVE-2023-37206?

The severity of this vulnerability is medium.

Q: How can an attacker exploit this vulnerability?

An attacker can trick a user into submitting sensitive data to a malicious website by uploading files containing symlinks.

Q: Where can I find more information about CVE-2023-37206?

You can find more information about this vulnerability in the following references: [link1](https://bugzilla.mozilla.org/show_bug.cgi?id=1813299), [link2](https://www.mozilla.org/security/advisories/mfsa2023-22/), [link3](https://launchpad.net/bugs/cve/CVE-2023-37206).

Published Jul 4, 2023

Updated

Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. This vulnerability affects Firefox < 115.

Affected Software

11 affected componentsFixes available

ubuntu/firefox<115.0-1

115.0-1

ubuntu/firefox<115.0+

115.0+

debian/firefox

123.0-1

Mozilla Firefox<115

115

Mozilla Firefox<115.0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/firefox to a version that resolves this vulnerability.
Fixed in 115.0-1
Upgrade
Upgrade ubuntu/firefox to a version that resolves this vulnerability.
Fixed in 115.0+
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 123.0-1
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 115
Upgrade
Upgrade alpine/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.0-r0

Event History

Jul 4, 2023

CVE Published

12:00 AM

Jul 5, 2023

CVE Published

via MITRE·09:02 AM

Data Sourced

via MITRE·09:02 AM

DescriptionWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·10:15 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID of this security issue?

The vulnerability ID is CVE-2023-37206.

What software is affected by this security vulnerability?

Firefox versions prior to 115 are affected.

What is the severity of CVE-2023-37206?

The severity of this vulnerability is medium.

How can an attacker exploit this vulnerability?

An attacker can trick a user into submitting sensitive data to a malicious website by uploading files containing symlinks.

Where can I find more information about CVE-2023-37206?

You can find more information about this vulnerability in the following references: [link1](https://bugzilla.mozilla.org/show_bug.cgi?id=1813299), [link2](https://www.mozilla.org/security/advisories/mfsa2023-22/), [link3](https://launchpad.net/bugs/cve/CVE-2023-37206).

CVE-2023-37206: Medium severity Mozilla Firefox vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the vulnerability ID of this security issue?

What software is affected by this security vulnerability?

What is the severity of CVE-2023-37206?

How can an attacker exploit this vulnerability?

Where can I find more information about CVE-2023-37206?

Company

Resources

Contact