Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-xwh8-4fp4-mvqf

Опубликовано: 02 июн. 2023
Источник: github
Github: Не прошло ревью
CVSS3: 6.5

Описание

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user.
This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user.
This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

EPSS

Процентиль: 34%
0.0013
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-22

Связанные уязвимости

CVSS3: 6.1
redhat
больше 2 лет назад

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

CVSS3: 6.5
nvd
около 2 лет назад

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

CVSS3: 6.5
debian
около 2 лет назад

When downloading files through the Save As dialog on Windows with sugg ...

CVSS3: 6.1
fstec
больше 2 лет назад

Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird операционных систем Windows, связанная с недостаточной защитой служебных данных, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

suse-cvrf
около 2 лет назад

Security update for MozillaThunderbird

EPSS

Процентиль: 34%
0.0013
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-22