Polkit Authentication Flaw in Mozilla VPN Client for Linux

CVE-2023-4104

What is CVE-2023-4104?

An improper Polkit Authentication check in the Mozilla VPN client for Linux allows local users to create and configure arbitrary VPN setups without the necessary credentials. This oversight compromises the integrity of VPN configurations, potentially enabling unauthorized access to secured networks and sensitive data. The issue is limited to versions prior to 2.16.1 on Linux, while other operating systems remain unaffected.

References