CVE-2023-4104
MEDIUMMozilla VPN < 2.16.1 (Linux) - Unauthenticated VPN Configuration via D-Bus
Title source: llmDescription
An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups. *This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 < (Linux).
References (6)
Core 6
Core References
Exploit, Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1831318
Issue Tracking, Patch
https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7055
Issue Tracking, Patch
https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7110
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-39/
Exploit, Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/08/03/1
Scores
CVSS v3
5.5
EPSS
0.0024
EPSS Percentile
46.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-862
Status
published
Products (1)
mozilla/vpn
< 2.16.1
Published
Sep 11, 2023
Tracked Since
Feb 18, 2026