CVE-2023-4054

MediumCVSS 5.5

Published: 01/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

A vulnerability in Firefox allows appref-ms files to be opened without warning the user that they may contain malicious code. This affects Firefox versions below 116 and Thunderbird versions below 102.14 and 115.1 on Windows.

Risk Assessment

The lack of warning when opening potentially dangerous files increases the risk of malware infection, which can lead to data loss or security breaches within the organization.

Recommendation

It is recommended to update Firefox and Thunderbird to the latest versions to minimize the risk associated with this vulnerability.

Original NVD description (English source)

When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1.