CVE-2023-25734

2023-06-0200:00:00

ubuntu.com

windows

firefox

url shortcut

network requests

ntlm credentials

cve-2023-25734

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.003

Percentile

68.4%

JSON

After downloading a Windows <code>.url</code> shortcut from the local
filesystem, an attacker could supply a remote path that would lead to
unexpected network requests from the operating system. This also had the
potential to leak NTLM credentials to the resource.<br>This bug only
affects Firefox on Windows. Other operating systems are unaffected.. This
vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR <
102.8.

Notes

Author	Note
tyhicks	mozjs contains a copy of the SpiderMonkey JavaScript engine
mdeslaur	starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap windows-specific