PT-2022-7089 · Mozilla+5 · Firefox+5

Eduardo Braun Prado · Published 2022-06-28 · Updated 2024-12-12 · CVE-2022-34483

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 102

Description The issue is related to insufficient warnings about dangerous actions in Mozilla Firefox. An attacker could exploit this by manipulating a filename to contain an executable extension when a user drags and drops an image to a filesystem, potentially tricking the user into executing malicious code.

Recommendations For versions prior to 102, update to version 102 or later to resolve the issue. As a temporary workaround, consider avoiding dragging and dropping images to the filesystem until a patch is available. Restrict access to executable extensions to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

CWE-357

Related Identifiers

ALT-PU-2022-2151

ALT-PU-2022-2458

ALT-PU-2022-2929

ALT-PU-2022-2930

ALT-PU-2023-1138

ALT-PU-2023-1139

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2023-07558

CVE-2022-34483

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2022_3396-1

OPENSUSE-SU-2024:12184-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2022:3272-1

SUSE-SU-2022:3273-1

SUSE-SU-2022:3396-1

USN-5504-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Firefox

Suse

Ubuntu

References · 2203

• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-23968 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45408 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-34483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4046 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22748 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22757 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29539 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-32205 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22738 · Security Note