CVE-2023-28163

Summary

CVE	CVE-2023-28163
State	PUBLISHED
Assigner	mozilla
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-06-02 17:15:12 UTC
Updated	2026-10-23 23:10:00 UTC
Description	When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Risk And Classification

Primary CVSS: v3.1 6.5 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS: 0.007980000 probability, percentile 0.561060000 (date 2026-10-23)

Problem Types: NVD-CWE-noinfo | CWE-22 | Windows Save As dialog resolved environment variables | CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	6.5	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
3.1	ADP	DECLARED	6.5	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	6.5	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Mozilla	Firefox	All	All	All	All
Application	Mozilla	Firefox Esr	All	All	All	All
Application	Mozilla	Thunderbird	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Mozilla	Firefox	affected unspecified 111 custom	Not specified
CNA	Mozilla	Firefox ESR	affected unspecified 102.9 custom	Not specified
CNA	Mozilla	Thunderbird	affected unspecified 102.9 custom	Not specified

References

Reference	Source	Link	Tags
Access Denied	134c704f-9b21-4f2e-91b3-4a467353bcc0	bugzilla.mozilla.org	Issue Tracking, Permissions Required, Vendor Advisory
Security Vulnerabilities fixed in Thunderbird 102.9 — Mozilla	af854a3a-2127-422b-91ae-364da2661108	www.mozilla.org	Vendor Advisory
Security Vulnerabilities fixed in Firefox ESR 102.9 — Mozilla	af854a3a-2127-422b-91ae-364da2661108	www.mozilla.org	Vendor Advisory
Security Vulnerabilities fixed in Firefox 111 — Mozilla	af854a3a-2127-422b-91ae-364da2661108	www.mozilla.org	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

354816 Amazon Linux Security Advisory for thunderbird : ALAS2-2023-1988
356287 Amazon Linux Security Advisory for firefox : ALASFIREFOX-2023-004
378071 Mozilla Firefox ESR Multiple Vulnerabilities (MFSA2023-10)
378072 Mozilla Firefox Multiple Vulnerabilities (MFSA2023-09)
378084 Mozilla Thunderbird Multiple Vulnerabilities (MFSA2023-11)
378383 Mozilla Firefox Multiple Vulnerabilities (MFSA2023-13)
378384 Mozilla Firefox ESR Multiple Vulnerabilities (MFSA2023-14)
378387 Mozilla Thunderbird Multiple Vulnerabilities (MFSA2023-15)
503456 Alpine Linux Security Update for firefox-esr
506064 Alpine Linux Security Update for firefox-esr
710735 Gentoo Linux Mozilla Thunderbird Multiple Vulnerabilities (GLSA 202305-36)
710739 Gentoo Linux Mozilla Firefox Multiple Vulnerabilities (GLSA 202305-35)
753768 SUSE Enterprise Linux Security Update for MozillaFirefox (SUSE-SU-2023:0728-1)
753800 SUSE Enterprise Linux Security Update for MozillaFirefox (SUSE-SU-2023:0763-1)
753830 SUSE Enterprise Linux Security Update for MozillaFirefox (SUSE-SU-2023:0835-1)