CVE-2018-12383

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Oct 18, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-123845.9When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. ThCVE-2018-123857.0A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profileCVE-2018-123868.1A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remCVE-2018-123879.1A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer beiCVE-2018-123888.8Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory corCVE-2018-123898.8Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memoCVE-2018-12397.2Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. CVE-2018-123909.8Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed eCVE-2018-123918.8During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. BecausCVE-2018-123929.8When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable cCVE-2018-123937.5A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 represCVE-2018-123957.5By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This