PT-2023-3738 · Mozilla+5 · Firefox+5

Ameen Basha M K + 1 · Published 2023-07-04 · Updated 2025-03-14 · CVE-2023-37203

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 115

Description The issue is related to insufficient validation in the Drag and Drop API, which, when combined with social engineering, may allow an attacker to trick end-users into creating a shortcut to local system files. This could potentially be leveraged to execute arbitrary code.

Recommendations For versions prior to 115, update to version 115 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Drag and Drop API until a patch is available.

Fix

Command Injection

RCE

Weakness Enumeration

CWE-77

CWE-20

Related Identifiers

ALT-PU-2023-4102

ALT-PU-2023-5754

ALT-PU-2023-6436

ALT-PU-2024-14035

ALT-PU-2024-3614

ALT-PU-2024-4241

BDU:2023-04026

CVE-2023-37203

OESA-2025-1265

OESA-2025-1268

OPENSUSE-SU-2023_2886-1

OPENSUSE-SU-2024:13037-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2023:2849-1

SUSE-SU-2023:2850-1

SUSE-SU-2023:2886-1

USN-6201-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Suse

Ubuntu

References · 2092

• https://nvd.nist.gov/vuln/detail/CVE-2024-7531 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4582 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-10467 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-36315 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9680 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7522 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-9402 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-9397 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-6206 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32208 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-5696 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5388 · Security Note