// For flags

CVE-2023-4581

Mozilla: XLL file extensions were downloadable without warnings

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.

Los archivos complementarios `.xll` de Excel no tenían una entrada en la lista de bloqueo ejecutable de Firefox, lo que permitía descargarlos sin ninguna advertencia sobre su daño potencial. Esta vulnerabilidad afecta a Firefox &lt; 117, Firefox ESR &lt; 102.15, Firefox ESR &lt; 115.2 y Thunderbird &lt; 115.2.

The Mozilla Foundation Security Advisory describes this flaw as:

Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm.

*Credits: Umar Farooq (@Puf)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-08-29 CVE Reserved
  • 2023-08-31 CVE Published
  • 2024-09-26 CVE Updated
  • 2024-10-13 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-1127: Compilation with Insufficient Warnings or Errors
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mozilla
Search vendor "Mozilla"
Firefox
Search vendor "Mozilla" for product "Firefox"
< 117.0
Search vendor "Mozilla" for product "Firefox" and version " < 117.0"
-
Affected
Mozilla
Search vendor "Mozilla"
Firefox Esr
Search vendor "Mozilla" for product "Firefox Esr"
< 102.15
Search vendor "Mozilla" for product "Firefox Esr" and version " < 102.15"
-
Affected
Mozilla
Search vendor "Mozilla"
Firefox Esr
Search vendor "Mozilla" for product "Firefox Esr"
>= 115.0 < 115.2
Search vendor "Mozilla" for product "Firefox Esr" and version " >= 115.0 < 115.2"
-
Affected
Mozilla
Search vendor "Mozilla"
Thunderbird
Search vendor "Mozilla" for product "Thunderbird"
< 115.2
Search vendor "Mozilla" for product "Thunderbird" and version " < 115.2"
-
Affected