CVE-2023-4104

An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods...

5.5 Medium

An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups. This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected. This vulnerability affects Mozilla VPN 2.16.1 < (Linux).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.33%Up 0.3 points since Sep 11, 2023

What each source reports

NVD Score used 5.5

Record: CVE-2023-4104
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

CVE List 5.5

Record: CVE-2023-4104
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2023-53994 5.5

Record: EUVD-2023-53994
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-f2fh-jcp2-h8mp 5.5

An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods...

Record: GHSA-f2fh-jcp2-h8mp
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSV 5.5

Record: CVE-2023-4104
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-4104 5.5

Record: UBUNTU-CVE-2023-4104
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`mozillavpn` Ubuntu:22.04:LTS	All versions, plus listed versions 2.2.0-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4104 is a medium vulnerability (CVSS 5.5) in Mozilla Vpn 2.16.1, published September 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. No source names a fixed version.

References

Show 7 moreShow less