CVE-2018-12383 — Insufficiently Protected Credentials in Mozilla Firefox

CWE-522 — Insufficiently Protected CredentialsCWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer12 documents8 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 76.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird+8 more
Timeline
PublishedOct 18
Latest updateMay 13

Description

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages10 packages

▶CVEListV5mozilla/firefoxunspecified — 62
▶NVDmozilla/firefox< 62.0
▶CVEListV5mozilla/firefox_esrunspecified — 60.2.1
▶NVDmozilla/firefox_esr< 60.2.1
▶CVEListV5mozilla/thunderbirdunspecified — 60.2.1

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 18.04, Enterprise Linux 7.6, 7.5

🔴Vulnerability Details

6
GHSA
GHSA-cvcq-m8cv-7r6g: If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible↗2022-05-13
▶
CVEList
CVE-2018-12383: If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible↗2018-10-18
▶
OSV
CVE-2018-12383: If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible↗2018-10-18
▶
OSV
thunderbird vulnerabilities↗2018-10-15
▶
OSV
firefox regressions↗2018-09-13
▶

📋Vendor Advisories

4
Ubuntu
Thunderbird vulnerabilities↗2018-10-15
▶
Ubuntu
Firefox vulnerabilities↗2018-09-06
▶
Red Hat
Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords↗2018-09-05
▶
Debian
CVE-2018-12383: firefox - If a user saved passwords before Firefox 58 and then later set a master password...↗2018
▶

💬Community

1
Bugzilla
CVE-2018-12383 Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords↗2018-09-05
▶
CVE-2018-12383 — Insufficiently Protected Credentials | cvebase