CVE-2019-9794 — Argument Injection in Mozilla Firefox
Severity
9.8CRITICALNVD
EPSS
0.4%
top 38.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 26
Latest updateMay 24
Description
A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. *Note: This issue only affects Windows operating systems. Other operating sy…
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages8 packages
🔴Vulnerability Details
2GHSA▶
GHSA-2cx8-vq8f-mwm5: A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs↗2022-05-24
OSV▶
CVE-2019-9794: A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs↗2019-04-26