CVE-2023-25740
published 2023-06-02CVE-2023-25740: After downloading a Windows .scf script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from…
PriorityP345high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.52%
40.9th percentile
After downloading a Windows .scf script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| mozilla | firefox | < 110.0 | 110.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= unspecified < 110 | 110 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_debian8.8LOW
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Mozilla: Opening local .scf files could cause unexpected network loads
vendor_redhat·2023-02-14·CVSS 8.8
CVE-2023-25740 [HIGH] Mozilla: Opening local .scf files could cause unexpected network loads
Mozilla: Opening local .scf files could cause unexpected network loads
After downloading a Windows .scf script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110.
The Mozilla Foundation Security Advisory: After downloading a Windows `.scf` script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource. This bug only affects Firefox for Windows. Other operati
Debian
CVE-2023-25740: firefox - After downloading a Windows <code>.scf</code> script from the local filesystem, ...
vendor_debian·2023·CVSS 8.8
CVE-2023-25740 [HIGH] CVE-2023-25740: firefox - After downloading a Windows <code>.scf</code> script from the local filesystem, ...
After downloading a Windows .scf script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2023-05: CVE-2023-25740
vendor_mozilla·CVSS 8.8
CVE-2023-25740 [HIGH] Mozilla Foundation Security Advisory 2023-05: CVE-2023-25740
Mozilla Foundation Security Advisory 2023-05
CVE: CVE-2023-25740
Product: Firefox
Impact: high
Fixed in: Firefox 110
GHSA
GHSA-g67q-47ww-68wp: After downloading a Windows
ghsa_unreviewed·2023-06-02
CVE-2023-25740 [HIGH] CWE-522 GHSA-g67q-47ww-68wp: After downloading a Windows
After downloading a Windows .scf script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-06-02
Published