PT-2017-3684 · Mozilla+2 · Firefox+2
Rob Wu
·
Publicado
2017-08-16
·
Atualizado
2024-12-12
·
CVE-2018-5105
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Firefox versions prior to 58
Description:
The issue is related to WebExtensions, which can bypass user prompts, allowing an arbitrarily downloaded file to be saved and then opened. This can lead to an executable file running with local user privileges without explicit user consent. The exploitation of this issue may allow an attacker to elevate their privileges.
Recommendations:
For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider disabling WebExtensions until a patch is available. Restrict access to downloadable files to minimize the risk of exploitation. Avoid using WebExtensions to open downloaded files until the issue is resolved.
Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Ubuntu