CVE-2023-4054 Security feature bypass in Firefox
Firefox on Windows failed to warn users about malicious appref-ms files, potentially allowing attackers to execute code without user awareness.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-4054?
CVE-2023-4054 is a medium-severity vulnerability in Mozilla Firefox, published on 1 Aug 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1.
Which versions are affected by CVE-2023-4054?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2023-4054?
Upgrade to a fixed version.
Is CVE-2023-4054 being exploited?
There is no known exploitation of CVE-2023-4054 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-ww29-fh6f-953x, UBUNTU-CVE-2023-4054.