CVE-2023-4052
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account.
Risk Assessment
The ability for non-privileged users to delete arbitrary files poses a serious risk to system integrity. An attacker could exploit this vulnerability for malicious actions on the system.
Recommendation
It is recommended to update Firefox to version 116 or later and Firefox ESR to version 115.1 or later to mitigate this vulnerability.
Original NVD description (English source)
The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.