PT-2022-5673 · Mozilla+4 · Firefox+4

Sergey Galich · Published 2022-10-18 · Updated 2024-12-12 · CVE-2022-42931

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 106

Description The issue is related to the Form Manager component of Firefox, which stores usernames in an unencrypted file on disk, instead of using the Password Manager component that utilizes encryption. This could allow a remote attacker to disclose protected information. The username is the specific variable affected by this issue.

Recommendations For versions prior to 106, update to version 106 or later to resolve the issue. As a temporary workaround, consider restricting access to the Form Manager component until a patch is available. Avoid using the Form Manager for saving logins until the issue is resolved.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

ALT-PU-2022-2886

ALT-PU-2022-3047

ALT-PU-2023-5754

ALT-PU-2023-6436

ALT-PU-2024-3614

BDU:2022-07068

CVE-2022-42931

OPENSUSE-SU-2024:12429-1

OPENSUSE-SU-2024:14572-1

USN-5709-1

USN-5709-2

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Ubuntu

References · 1895

• 🔥 https://github.com/mistymntncop/CVE-2023-4863 · Exploit
• 🔥 https://github.com/LiveOverflow/webp-CVE-2023-4863 · Exploit
• 🔥 https://github.com/wrv/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/UT-Security/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/bbaranoff/CVE-2023-4863 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1780571 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:12429-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5709-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5709-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-42931 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42931 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-42931 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-42931 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2022-44 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-42927 · Vendor Advisory