Riskcovery

CVE-2023-4052

State
Published
Severity
Not scored
Published
Aug 1, 2023
Updated
Oct 22, 2024
Reserved
Aug 1, 2023

Read the record on cve.org

Description

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
FirefoxMozilla
  • before 116Affected
Firefox ESRMozilla
  • before 115.1Affected
ThunderbirdMozilla
  • before 115.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.