CVE-2019-11733: mozilla firefox Improper Authentication
Vulnerability summary
CVE-2019-11733 is a critical (CVSS 9.8) Improper Authentication vulnerability in mozilla firefox. EPSS estimates a 1.41% chance of exploitation in the next 30 days, higher than 72.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 11 · Related 7Timeline
- 27-09-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.41%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.41% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla2 products
- firefox≥ unspecified, < 68.0.2 | < 68.0.2
- firefox_esr≥ unspecified, < 68.0.2
Ubuntu1 product
- firefox< 68.0.2+build1-0ubuntu0.16.04.1 | < 68.0.2+build1-0ubuntu0.18.04.1
2 vendors · 3 products
References
8 links- bugzilla.mozilla.org/show_bug.cgi?id=1565780X Refsource MISCIssue TrackingPermissions RequiredVendor Advisory