CVE-2023-25741 Information disclosure in Firefox
Cross-origin image drag-and-drop could leak image size information, affecting Firefox users prior to version 110.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-25741?
CVE-2023-25741 is a medium-severity vulnerability in Mozilla Firefox, published on 2 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility problems as well as this security concern, so the behavior was disabled until further review. This vulnerability affects Firefox < 110.
Weakness: CWE-203
Which versions are affected by CVE-2023-25741?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2023-25741?
Upgrade to a fixed version.
Is CVE-2023-25741 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25741 exists.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-77mp-cm2p-44gj, UBUNTU-CVE-2023-25741.