From prodefence.org
The latest update released by Mozilla for Firefox patches a flaw in Firefox Password Manager that can be exploited to access stored passwords.
The latest release for Mozilla Firefox (Firefox 68.0.2) fixes a vulnerability that can be exploited to bypass the master password in Firefox Password Manager and access stored passwords.
“When a master password is set, it is required to be entered before stored passwords can be accessed in the ‘Saved Logins’ dialog.” reads the advisory published by Mozilla. “It was found that locally stored passwords can be copied to the clipboard thorough the ‘copy password’ context menu item without first entering the master password, allowing for potential theft of stored passwords.“
The vulnerability, tracked as CVE-2019-11733, was rated as “moderate impact”
When a master password is set, it must be provided to access the saved login credentials from the Saved Logins menu. Users can see the stored passwords by pressing the “Show Passwords” button and then entering the master password.
Read more…