CVE-2018-12383

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-10-18 · updated 2026-06-17
Weakness: CWE-522

Description

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04
Debian Linux: 8.0, 9.0
Mozilla Firefox: before 62.0 — fixed in 62.0
Mozilla Firefox ESR: before 60.2.1 — fixed in 60.2.1
Mozilla Thunderbird: before 60.2.1 — fixed in 60.2.1
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Server Aus: 7.6
RedHat Enterprise Linux Server Eus: 7.5, 7.6
RedHat Enterprise Linux Server Tus: 7.6
RedHat Enterprise Linux Workstation: 6.0, 7.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 62.0; Mozilla Firefox ESR 60.2.1; Mozilla Thunderbird 60.2.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-12383 or the next vulnerability affects your stack