Lucene search

PRIOn knowledge basePRION:CVE-2023-4052

HistoryAug 01, 2023 - 3:15 p.m.

Arbitrary file deletion

2023-08-0115:15:00

PRIOn knowledge base

www.prio-n.com

arbitrary file deletion

firefox

windows

vulnerability

directory

uninstall

junction

symbolic link

non-privileged user

nvd

thunderbird

firefox esr

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.0%

JSON

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user.
This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.

CPENameOperatorVersion
firefoxlt116.0
firefox_esrlt115.1

CPE	Name	Operator	Version
	firefox	lt	116.0
	firefox_esr	lt	115.1

References

bugzilla.mozilla.org/show_bug.cgi?id=1824420

www.mozilla.org/security/advisories/mfsa2023-29/

www.mozilla.org/security/advisories/mfsa2023-31/

www.mozilla.org/security/advisories/mfsa2023-33/