CVE-2023-4104

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups. *This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 < (Linux).

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-410406.5GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from th CVE-2023-410413.1Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session CVE-2023-410426.5Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `te CVE-2023-410436.5Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `te CVE-2023-410443.8Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The CVE-2023-410455.3Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single CVE-2023-410466.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute CVE-2023-410476.5OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious CVE-2023-410485.4plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions CVE-2023-410496.1@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in CVE-2023-41054.3Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and downloa CVE-2023-410507.7AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format s