{"id":"CVE-2023-4104","aliases":["EUVD-2023-53994","GHSA-f2fh-jcp2-h8mp","UBUNTU-CVE-2023-4104"],"status":"published","title":"An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods...","description":"An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.\n*This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 \u003c (Linux).","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00334,"percentile":0.27046,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2023-09-11T08:02:53Z","modified":"2026-10-28T02:30:43Z","affected":[{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozillavpn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-1"]}],"products":[{"vendor":"mozilla","product":"mozilla vpn 2.16.1"},{"vendor":"mozilla","product":"mozilla vpn client for linux"},{"vendor":"mozilla","product":"vpn"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1831318","tags":["x_transferred","Exploit","Issue Tracking","report"]},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7055","tags":["x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7110","tags":["x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7151","tags":["x_transferred","Issue Tracking","fix","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-39/","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2023/08/03/1","tags":["x_transferred","Exploit","Mailing List","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4104","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-39"},{"url":"https://github.com/advisories/GHSA-f2fh-jcp2-h8mp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4104.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-4104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4104","tags":["report"]},{"url":"https://github.com/mozilla-mobile/mozilla-vpn-client","tags":["report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1209921","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-4104","description":"An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.\n*This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 \u003c (Linux).","status":"published","published":"2023-09-11T08:02:53.854Z","modified":"2025-07-03T13:57:22.751Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:35:30.851125Z"}],"euvd":[{"id":"EUVD-2023-53994","description":"An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.\n*This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 \u003c (Linux).","status":"published","published":"2023-09-11T08:02:53Z","modified":"2025-07-03T13:57:22Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:14.284181Z"}],"ghsa":[{"id":"GHSA-f2fh-jcp2-h8mp","title":"An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods...","description":"An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.\n*This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN client for Linux \u003c v2.16.1.","status":"published","published":"2023-09-11T09:31:44Z","modified":"2024-04-04T07:34:45Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:56:52.639328Z"}],"nvd":[{"id":"CVE-2023-4104","description":"An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.\n*This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 \u003c (Linux).","status":"published","published":"2023-09-11T09:15:08.997Z","modified":"2026-06-17T06:37:05.35Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:08:28.268644Z"}],"osv":[{"id":"CVE-2023-4104","description":"An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.\n*This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 \u003c (Linux).","status":"published","published":"2023-09-11T08:02:53.854Z","modified":"2026-10-28T02:30:43.605143294Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"UBUNTU-CVE-2023-4104","description":"An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups. *This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 \u003c (Linux).","status":"published","published":"2023-09-11T09:15:00Z","modified":"2026-02-13T18:17:50.311979Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"}]}}