CVE-2023-28163
When downloading files through the Save As dialog on Windows with suggested filenames containing...
6.5 MediumFix available
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
0.80%Up 0.8 points since Jun 3, 2023
What each source reports
NVD Score used
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
- Record
CVE-2023-28163- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
- Record
CVE-2023-28163- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2023-31871
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
- Record
EUVD-2023-31871- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xwh8-4fp4-mvqf
When downloading files through the Save As dialog on Windows with suggested filenames containing...
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
- Record
GHSA-xwh8-4fp4-mvqf- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-28163
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
- Record
ALPINE-CVE-2023-28163- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSVUBUNTU-CVE-2023-28163
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
- Record
UBUNTU-CVE-2023-28163- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVopenSUSE-SU-2024:12786-1 No score
libmozjs-102-0-102.9.0-1.1 on GA media
These are all security issues fixed in the libmozjs-102-0-102.9.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12786-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12791-1 No score
MozillaThunderbird-102.9.0-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-102.9.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12791-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12839-1 No score
MozillaFirefox-111.0.1-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-111.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12839-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0728-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Update to version 102.9.0 ESR (bsc#1209173):
- CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
- CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
- CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
- CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
- CVE-2023-25751: Incorrect code generation during JIT compilation
- CVE-2023-28160: Redirect to Web Extension files may have leaked local path
- CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
- CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab
- CVE-2023-28162: Invalid downcast in Worklets
- CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
- CVE-2023-28163: Windows Save As dialog resolved environment variables
- CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
- CVE-2023-28177: Memory safety bugs fixed in Firefox 111
- Record
SUSE-SU-2023:0728-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0763-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Update to version 102.9.0 ESR (bsc#1209173):
- CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
- CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
- CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
- CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
- CVE-2023-25751: Incorrect code generation during JIT compilation
- CVE-2023-28160: Redirect to Web Extension files may have leaked local path
- CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
- CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab
- CVE-2023-28162: Invalid downcast in Worklets
- CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
- CVE-2023-28163: Windows Save As dialog resolved environment variables
- CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
- CVE-2023-28177: Memory safety bugs fixed in Firefox 111
- Record
SUSE-SU-2023:0763-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0835-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Update to version 102.9.0 ESR (bsc#1209173):
- CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
- CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
- CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
- CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
- CVE-2023-25751: Incorrect code generation during JIT compilation
- CVE-2023-28160: Redirect to Web Extension files may have leaked local path
- CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
- CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab
- CVE-2023-28162: Invalid downcast in Worklets
- CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
- CVE-2023-28163: Windows Save As dialog resolved environment variables
- CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
- CVE-2023-28177: Memory safety bugs fixed in Firefox 111
- Record
SUSE-SU-2023:0835-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:1736-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
MFSA 2023-12 (bsc#1209953):
- CVE-2023-28427: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (bmo#1822595)
MFSA 2023-11 (bsc#1209173):
- CVE-2023-25751: Incorrect code generation during JIT compilation (bmo#1814899).
- CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation (bmo#1809122).
- CVE-2023-28162: Invalid downcast in Worklets (bmo#1811327).
- CVE-2023-25752: Potential out-of-bounds when accessing throttled streams (bmo#1811627).
- CVE-2023-28163: Windows Save As dialog resolved environment variables (bmo#1817768)
- CVE-2023-28176: Memory safety bugs fixed in Thunderbird 102.9 (bmo#1808352, bmo#1811637, bmo#1815904, bmo#1817442, bmo#1818674).
Mozilla Thunderbird 102.9:
- fixed: Notification about a sender's changed OpenPGP key was not immediately visible (bmo#1814003)
- fixed: TLS Certificate Override dialog did not appear when retrieving messages via IMAP using 'Get Messages' context menu (bmo#1816596)
- fixed: Spellcheck dictionaries were missing from localized Thunderbird builds that should have included them (bmo#1818257)
- fixed: Tooltips for 'Show/Hide' calendar toggle did not display (bmo#1809557)
- fixed: Various security fixes
Mozilla Thunderbird 102.9.1:
- fixed: Thunderbird was unable to open file URLs from command line (URLs beginning with 'file://') (bmo#1816343)
- fixed: Source strings for localized builds not uploaded to FTP as expected (bmo#1817086)
- fixed: Visual and theme improvements (bmo#1821358, bmo#1822286)
- fixed: Security fixes
- Record
SUSE-SU-2023:1736-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefox-esrAlpine:v3.18 |
before 102.9.0-r0 | 102.9.0-r0 |
firefox-esrAlpine:v3.19 |
before 102.9.0-r0 | 102.9.0-r0 |
firefox-esrAlpine:v3.20 |
before 102.9.0-r0 | 102.9.0-r0 |
firefox-esrAlpine:v3.21 |
before 102.9.0-r0 | 102.9.0-r0 |
firefox-esrAlpine:v3.22 |
before 102.9.0-r0 | 102.9.0-r0 |
firefox-esrAlpine:v3.23 |
before 102.9.0-r0 | 102.9.0-r0 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150000.150.79.1 | 102.9.0-150000.150.79.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150000.150.79.1 | 102.9.0-150000.150.79.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 13 CVEs |
before 102.9.0-150000.150.79.1 | 102.9.0-150000.150.79.1 |
MozillaFirefoxSUSE:OpenStack Cloud 9 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4-ESPOS From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 13 CVEs |
before 102.9.0-112.153.1 | 102.9.0-112.153.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Real Time 15 SP3 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Enterprise Storage 7 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxSUSE:Enterprise Storage 7.1 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaFirefoxopenSUSE:Leap 15.4 From an advisory covering 13 CVEs |
before 102.9.0-150200.152.81.1 | 102.9.0-150200.152.81.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP4 From an advisory covering 7 CVEs |
before 102.9.1-150200.8.110.2 | 102.9.1-150200.8.110.2 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP4 From an advisory covering 7 CVEs |
before 102.9.1-150200.8.110.2 | 102.9.1-150200.8.110.2 |
MozillaThunderbirdopenSUSE:Leap 15.4 From an advisory covering 7 CVEs |
before 102.9.1-150200.8.110.2 | 102.9.1-150200.8.110.2 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 102.9.0-1.1 | 102.9.0-1.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 13 CVEs |
before 111.0.1-1.1 | 111.0.1-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-28163 is a medium vulnerability (CVSS 6.5) in Mozilla Firefox, published March 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in firefox-esr 102.9.0-r0.
References
mozilla.org/security/advisories/mfsa2023-09
bugzilla.mozilla.org/show_bug.cgi?id=1817768
nvd.nist.gov/vuln/detail/CVE-2023-28163
github.com/advisories/GHSA-xwh8-4fp4-mvqf
Show 194 moreShow less
security.alpinelinux.org/vuln/CVE-2023-28163
suse.com/support/update/announcement/2023/suse-su-20230728-1
bugzilla.suse.com/1209173
ubuntu.com/security/CVE-2023-28163
cve.org/CVERecord?id=CVE-2023-28163
lists.opensuse.org/archives/list/[email protected]/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
This page doesn't list everything
Left out here: 1,680 references. The JSON record has them.