Уязвимость копирования сохраненных паролей в буфер обмена в Mozilla Firefox через обход мастер-пароля
Описание
При установке мастер-пароля требуется его повторный ввод для доступа к сохраненным паролям через диалог "Сохраненные логины". Обнаружено, что локально сохраненные пароли могут быть скопированы в буфер обмена через пункт контекстного меню "копировать пароль" без повторного ввода главного пароля, если главный пароль уже был введен в текущей сессии. Это допускает потенциальную кражу сохраненных паролей.
Затронутые версии ПО
- Firefox версии ниже 68.0.2
- Firefox ESR версии ниже 68.0.2
Тип уязвимости
Утечка паролей
Ссылки
- Issue TrackingPermissions RequiredVendor Advisory
- Vendor Advisory
- Issue TrackingPermissions RequiredVendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
9.8 Critical
CVSS3
5 Medium
CVSS2
Дефекты
Связанные уязвимости
When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.
When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.
When a master password is set, it is required to be entered again befo ...
When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.
EPSS
9.8 Critical
CVSS3
5 Medium
CVSS2