CVE-2023-4052

The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.

• CWE-59

• https://bugzilla.mozilla.org/show_bug.cgi?id=1824420Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-33/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1824420Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-33/

Published

Aug 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40514LG Simple Editor FileManagerController getImageByFilename Di…6.5
• CVE-2023-40515LG Simple Editor joinAddUser Improper Input Validation Denia…7.5
• CVE-2023-40516LG Simple Editor Incorrect Permission Assignment Local Privi…7.8
• CVE-2023-40517LG SuperSign Media Editor ContentRestController getObject Di…7.5
• CVE-2023-40518LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly vali…7.5
• CVE-2023-40519A cross-site scripting (XSS) vulnerability in the bpk-common…6.1
• CVE-2023-40520The issue was addressed with improved checks. This issue is …3.3
• CVE-2023-40528This issue was addressed by removing the vulnerable code. Th…5.5
• CVE-2023-40529This issue was addressed with improved redaction of sensitiv…2.4
• CVE-2023-4053A website could have obscured the full screen notification b…6.5
• CVE-2023-40530Improper authorization in handler for custom URL scheme issu…4.7
• CVE-2023-40531Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_…8