#VU20292 Unprotected storage of credentials in Firefox ESR and Mozilla Firefox - CVE-2019-11733
Published: August 15, 2019
Vulnerability identifier: #VU20292
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-11733
CWE-ID: CWE-256
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Firefox ESR
Mozilla Firefox
Firefox ESR
Mozilla Firefox
Software vendor:
Mozilla
Mozilla
Description
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to a logical error in the way stored passwords are processed. A local user can access stored passwords in the 'Saved Logins' dialog, as locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without first entering the master password.
Remediation
Install updates from vendor's website.