CVE-2019-11733

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog

published September 27, 2019

CVSS
—
EPSS
1%
Percentile
72.5
In the wild
Unconfirmed
What it is

⚠️ A surprising loophole here: if you've entered your master password, a single click can copy your stored passwords straight to the clipboard without re-authentication! 😲 Think of it like a restaurant where you only need to show your ID once to enter, but then anyone can walk up and grab a takeout order with your name on it, no questions asked. That’s exactly what’s happening with saved passwords in Firefox! An attacker with access to your session could snag all your stored passwords effortlessly. This means your sensitive accounts could be exposed, potentially leading to identity theft or unauthorized access—absolutely devastating!

Put simply

Think of it like a restaurant where you only need to show your ID once to enter, but then anyone can walk up and grab a takeout order with your name on it, no questions asked. That’s exactly what’s happening with saved passwords in Firefox! This vulnerability allows locally stored passwords to be copied to the clipboard through the 'copy password' context menu item without needing to re-enter the master password if it has already been input in the session.

What to do

An attacker with access to your session could snag all your stored passwords effortlessly. This means your sensitive accounts could be exposed, potentially leading to identity theft or unauthorized access—absolutely devastating! Update Firefox to version 68.0.2 or later to secure your passwords. For additional protection, consider using a stronger password manager and ensure your security settings are adjusted accordingly. You've got this! Follow these steps to safeguard your passwords and elevate your security hero status! 🦸

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01411 · 72.5th percentile
Published
2019-09-27T17:22Z
EPSS history
Timeline
  • 27 SEP 17:22Z
    When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog
    cvelistv5