CVE-2023-23597

Description

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `file://` context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefox < 109.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.15%• Percentile: 35%

Techniques & Countermeasures

• CWE-326•Inadequate Encryption Strength

  The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Affected Systems

• mozilla•firefox

  < 109.0 | ≥ unspecified, < 109

References (2)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1538028
• https://www.mozilla.org/security/advisories/mfsa2023-01/