Auth bypass in Mozilla Firefox
CVE-2019-11733
When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.014 (71.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 71.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
Weakness classification (CWE)
References
- bugzilla.mozilla.org/show_bug.cgi (Permissions Required, Issue Tracking, Vendor Advisory)
- www.mozilla.org/security/advisories/mfsa2019-24/ (Vendor Advisory)
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html (vendor-advisory)
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html (vendor-advisory)
Frequently asked questions
- What is CVE-2019-11733?
- CVE-2019-11733 is a critical-severity vulnerability in Mozilla Firefox, classified under Improper Authentication. CVSS score: 9.8/10. Published 2019-09-27.
- How severe is CVE-2019-11733?
- Critical severity. CVSS v3 base score is 9.8 out of 10.