CVE-2023-25731 Code injection in Firefox
Attackers can execute arbitrary code in privileged contexts via malicious URLs in Firefox developer tools network panel previews.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-25731?
CVE-2023-25731 is a high-severity code injection vulnerability in Mozilla Firefox, published on 2 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.
Weakness: CWE-1284
Which versions are affected by CVE-2023-25731?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2023-25731?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-25731 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25731 exists.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-v7qx-gcjm-59m5, UBUNTU-CVE-2023-25731.