CVE-2023-25734

CVSS v3.1 8.1 (High)

EPSS 0.27 % (68^th)

Affected Products 4

Advisories 13

After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.<br>This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Weaknesses

CWE-NVD-noinfo

CVE Status: PUBLISHED
CNA: Mozilla Corporation
Published Date: 2023-06-02 17:15:11
(15 months ago)
Updated Date: 2023-06-08 15:57:02
(15 months ago)

Affected Products

Microsoft

Windows

Mozilla

Configuration #1

AND

		CPE23	Up To
OR
	Mozilla Firefox prior 110.0 version	cpe:2.3:a:mozilla:firefox	< 110.0
OR
	Running on/with
	Mozilla Firefox Esr prior 102.8 version	cpe:2.3:a:mozilla:firefox_esr	< 102.8
OR
	Running on/with
	Mozilla Thunderbird prior 102.8 version	cpe:2.3:a:mozilla:thunderbird	< 102.8
OR
	Running on/with
	Microsoft Windows	cpe:2.3:o:microsoft:windows:-