{"id":"CVE-2018-12383","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-12383","generatedAt":"2026-10-28T23:58:17.881Z","title":"This could allow the exposure of stored password data outside of user expectations.","description":"If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1.","published":"2018-10-18T13:29:06.000Z","lastModified":"2026-06-17T01:37:40.000Z","status":"Modified","sourceIdentifier":"security@mozilla.org","cvss":{"version":"3.0","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-522"],"affected":["redhat/enterprise linux desktop","redhat/enterprise linux server","redhat/enterprise linux server aus","redhat/enterprise linux server eus","redhat/enterprise linux server tus","redhat/enterprise linux workstation","debian/debian linux","canonical/ubuntu linux","mozilla/firefox","mozilla/firefox esr","mozilla/thunderbird"],"epss":{"score":0.0046,"percentile":0.39729,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.46%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/105276","tags":["Third Party Advisory","VDB Entry"],"source":"security@mozilla.org"},{"url":"http://www.securitytracker.com/id/1041610","tags":["Third Party Advisory","VDB Entry"],"source":"security@mozilla.org"},{"url":"http://www.securitytracker.com/id/1041701","tags":["Third Party Advisory","VDB Entry"],"source":"security@mozilla.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:2834","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:2835","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3403","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:3458","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1475775","tags":["Exploit","Issue Tracking","Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://security.gentoo.org/glsa/201810-01","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://security.gentoo.org/glsa/201811-13","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://usn.ubuntu.com/3761-1/","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://usn.ubuntu.com/3793-1/","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://www.debian.org/security/2018/dsa-4304","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://www.debian.org/security/2018/dsa-4327","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2018-20/","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2018-23/","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2018-25/","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"http://www.securityfocus.com/bid/105276","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1041610","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1041701","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:2834","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:2835","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3403","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3458","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1475775","tags":["Exploit","Issue Tracking","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201810-01","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201811-13","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3761-1/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3793-1/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4304","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4327","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mozilla.org/security/advisories/mfsa2018-20/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mozilla.org/security/advisories/mfsa2018-23/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mozilla.org/security/advisories/mfsa2018-25/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-12383","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}