PT-2023-3738 · Mozilla+5 · Firefox+5
Ameen Basha M K
+1
·
Publicado
2023-07-04
·
Atualizado
2025-03-14
·
CVE-2023-37203
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 115
Description
The issue is related to insufficient validation in the Drag and Drop API, which, when combined with social engineering, may allow an attacker to trick end-users into creating a shortcut to local system files. This could potentially be leveraged to execute arbitrary code.
Recommendations
For versions prior to 115, update to version 115 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Drag and Drop API until a patch is available.
Correção
Command Injection
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Firefox
Linuxmint
Suse
Ubuntu