#VU73674 Information disclosure in Mozilla Firefox and Firefox ESR - CVE-2023-28163
Published: March 14, 2023
Vulnerability identifier: #VU73674
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-28163
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Mozilla Firefox
Firefox ESR
Mozilla Firefox
Firefox ESR
Software vendor:
Mozilla
Mozilla
Description
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application when downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names. A remote attacker can gain unauthorized access to sensitive information on the system.
Note, the vulnerability affects only Windows installations.
Remediation
Install updates from vendor's website.