CVE-2023-4104

An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups. *This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 < (Linux).

• CWE-862
• CWE-862

• https://bugzilla.mozilla.org/show_bug.cgi?id=1831318Exploit, Issue Tracking
• https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7055Issue Tracking, Patch
• https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7110Issue Tracking, Patch
• https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7151Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2023-39/Vendor Advisory
• https://www.openwall.com/lists/oss-security/2023/08/03/1Exploit, Mailing List, Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1831318Exploit, Issue Tracking
• https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7055Issue Tracking, Patch
• https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7110Issue Tracking, Patch
• https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7151Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2023-39/Vendor Advisory
• https://www.openwall.com/lists/oss-security/2023/08/03/1Exploit, Mailing List, Third Party Advisory

Published

Sep 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41033A vulnerability has been identified in Parasolid V35.0 (All …7.8
• CVE-2023-41034Eclipse Leshan is a device management server and client Java…9.8
• CVE-2023-41036Macvim is a text editor for MacOS. Prior to version 178, Mac…7.8
• CVE-2023-41037OpenPGP.js is a JavaScript implementation of the OpenPGP pro…4.3
• CVE-2023-41038Firebird is a relational database. Versions 4.0.0 through 4.…7.5
• CVE-2023-41039RestrictedPython is a restricted execution environment for P…7.7
• CVE-2023-41040GitPython is a python library used to interact with Git repo…6.5
• CVE-2023-41041Graylog is a free and open log management platform. In a mul…3.1
• CVE-2023-41042Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-41043Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-41044Graylog is a free and open log management platform. A partia…3.8
• CVE-2023-41045Graylog is a free and open log management platform. Graylog …5.3