CVE-2023-5726 — Product UI does not Warn User of Unsafe Actions in Mozilla Firefox

CWE-356 — Product UI does not Warn User of Unsafe Actions9 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 61.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird
Timeline
PublishedOct 25

Description

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. *Note: This issue only affected macOS operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages7 packages

▶CVEListV5mozilla/firefoxunspecified — 119
▶NVDmozilla/firefox< 119.0
▶CVEListV5mozilla/firefox_esrunspecified — 115.4
▶NVDmozilla/firefox_esr< 115.4
▶CVEListV5mozilla/thunderbirdunspecified — 115.4.1

🔴Vulnerability Details

3
GHSA
GHSA-cxxg-52f9-f5mj: A website could have obscured the full screen notification by using the file open dialog↗2023-10-25
▶
OSV
CVE-2023-5726: A website could have obscured the full screen notification by using the file open dialog↗2023-10-25
▶
CVEList
CVE-2023-5726: A website could have obscured the full screen notification by using the file open dialog↗2023-10-24
▶

📋Vendor Advisories

5
Red Hat
Mozilla: Full screen notification obscured by file open dialog on macOS↗2023-10-24
▶
Debian
CVE-2023-5726: firefox - A website could have obscured the full screen notification by using the file ope...↗2023
▶
Mozilla
Mozilla Foundation Security Advisory 2023-45: CVE-2023-5726↗
▶
Mozilla
Mozilla Foundation Security Advisory 2023-46: CVE-2023-5726↗
▶
Mozilla
Mozilla Foundation Security Advisory 2023-47: CVE-2023-5726↗
▶
CVE-2023-5726 — Mozilla Firefox vulnerability | cvebase