CVE-2023-4580 — Push notifications saved to disk unencrypted

Back Back to CVE browser

MEDIUM

Push notifications saved to disk unencrypted

Published Sep 11, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.42%

Description

Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <117
Vendor Mozilla Product Firefox ESR Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <115.2
Vendor Mozilla Product Thunderbird Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <115.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<117

Mozilla

Firefox ESR

n/a

Version	Status	Constraints
unspecified	affected	<115.2

Mozilla

Thunderbird

n/a

Version	Status	Constraints
unspecified	affected	<115.2

Red Hat Enterprise Linux 7

firefox-0:102.15.0-1.el7_9

Fixed · RHSA-2023:5019
Red Hat Enterprise Linux 7

thunderbird-0:102.15.0-1.el7_9

Fixed · RHSA-2023:4945
Red Hat Enterprise Linux 8

firefox-0:102.15.0-1.el8_8

Fixed · RHSA-2023:4952
Red Hat Enterprise Linux 8

thunderbird-0:102.15.0-1.el8_8

Fixed · RHSA-2023:4954
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

firefox-0:102.15.0-1.el8_1

Fixed · RHSA-2023:4949
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

thunderbird-0:102.15.0-1.el8_1

Fixed · RHSA-2023:4948
Red Hat Enterprise Linux 8.2 Advanced Update Support

firefox-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Advanced Update Support

thunderbird-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Telecommunications Update Service

firefox-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Telecommunications Update Service

thunderbird-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

firefox-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

thunderbird-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4946
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

firefox-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

thunderbird-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Telecommunications Update Service

firefox-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Telecommunications Update Service

thunderbird-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

firefox-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

thunderbird-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4956
Red Hat Enterprise Linux 8.6 Extended Update Support

firefox-0:102.15.0-1.el8_6

Fixed · RHSA-2023:4959
Red Hat Enterprise Linux 9

firefox-0:102.15.0-1.el9_2

Fixed · RHSA-2023:4958
Red Hat Enterprise Linux 9

thunderbird-0:102.15.0-1.el9_2

Fixed · RHSA-2023:4955
Red Hat Enterprise Linux 9.0 Extended Update Support

firefox-0:102.15.0-1.el9_0

Fixed · RHSA-2023:4950
Red Hat Enterprise Linux 9.0 Extended Update Support

thunderbird-0:102.15.0-1.el9_0

Fixed · RHSA-2023:4947
Red Hat Enterprise Linux 6

firefox

Out of support scope
Red Hat Enterprise Linux 6

thunderbird

Out of support scope

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	firefox-0:102.15.0-1.el7_9	Fixed	RHSA-2023:5019
Red Hat Enterprise Linux 7	thunderbird-0:102.15.0-1.el7_9	Fixed	RHSA-2023:4945
Red Hat Enterprise Linux 8	firefox-0:102.15.0-1.el8_8	Fixed	RHSA-2023:4952
Red Hat Enterprise Linux 8	thunderbird-0:102.15.0-1.el8_8	Fixed	RHSA-2023:4954
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	firefox-0:102.15.0-1.el8_1	Fixed	RHSA-2023:4949
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	thunderbird-0:102.15.0-1.el8_1	Fixed	RHSA-2023:4948
Red Hat Enterprise Linux 8.2 Advanced Update Support	firefox-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Advanced Update Support	thunderbird-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Telecommunications Update Service	firefox-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Telecommunications Update Service	thunderbird-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	firefox-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	thunderbird-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4946
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	firefox-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	thunderbird-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Telecommunications Update Service	firefox-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Telecommunications Update Service	thunderbird-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	firefox-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	thunderbird-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4956
Red Hat Enterprise Linux 8.6 Extended Update Support	firefox-0:102.15.0-1.el8_6	Fixed	RHSA-2023:4959
Red Hat Enterprise Linux 9	firefox-0:102.15.0-1.el9_2	Fixed	RHSA-2023:4958
Red Hat Enterprise Linux 9	thunderbird-0:102.15.0-1.el9_2	Fixed	RHSA-2023:4955
Red Hat Enterprise Linux 9.0 Extended Update Support	firefox-0:102.15.0-1.el9_0	Fixed	RHSA-2023:4950
Red Hat Enterprise Linux 9.0 Extended Update Support	thunderbird-0:102.15.0-1.el9_0	Fixed	RHSA-2023:4947
Red Hat Enterprise Linux 6	firefox	Out of support scope	n/a
Red Hat Enterprise Linux 6	thunderbird	Out of support scope	n/a

Remediation

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Metrics

0.42% 0.00422

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00422

Score over time

2023–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (7 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.42% (0.00422)	34.22th	v5 (v2026.06.15)
Jun 15, 2026	0.36% (0.00364)	28.06th	v5 (v2026.06.15)
Mar 17, 2025	0.16% (0.00157)	33.93th	v4 (v2025.03.14)
Dec 12, 2024	0.11% (0.00110)	45.83th	v3 (v2023.03.01)
Jun 14, 2024	0.06% (0.00060)	25.82th	v3 (v2023.03.01)
Sep 14, 2023	0.06% (0.00060)	23.75th	v3 (v2023.03.01)
Sep 11, 2023	0.04% (0.00045)	12.27th	v3 (v2023.03.01)

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-311

Missing Encryption of Sensitive Data

References (9)

https://access.redhat.com/security/cve/CVE-2023-4580
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1843046
Issue TrackingPermissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2236079
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2023-4580
https://www.cve.org/CVERecord?id=CVE-2023-4580
https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4580
https://www.mozilla.org/security/advisories/mfsa2023-34/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-36/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-38/
Vendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-4580		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1843046		Issue TrackingPermissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2236079		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2023-4580
https://www.cve.org/CVERecord?id=CVE-2023-4580
https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4580
https://www.mozilla.org/security/advisories/mfsa2023-34/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-36/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-38/		Vendor Advisory