CVEvulnerability
CVE-2017-7821
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-06-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-732
Description
A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those document types. This vulnerability affects Firefox < 56.
Affected configurations
• mozilla firefox (<= 55.0.3)
Related
Weakness · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
References
- http://www.securityfocus.com/bid/101057 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039465 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1346515 Exploit, Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2017-21/ Vendor Advisory
- http://www.securityfocus.com/bid/101057 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039465 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1346515 Exploit, Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2017-21/ Vendor Advisory