CVE-2020-6799 — Argument Injection in Mozilla Firefox
Severity
8.8HIGHNVD
EPSS
0.5%
top 35.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 2
Latest updateMay 24
Description
Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that insufficiently sanitized URL data. In that situation, clicking a link in the third party application could have been used to retrieve and execute files whose location was supplied through command line arguments. No…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages3 packages
Patches
🔴Vulnerability Details
2GHSA▶
GHSA-8h3q-5823-cjpv: Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types↗2022-05-24
CVEList▶
CVE-2020-6799: Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types↗2020-03-02
📋Vendor Advisories
4💬Community
1Bugzilla▶
CVE-2020-6799 Mozilla: Arbitrary code execution when opening pdf links from other applications, when Firefox is configured as default pdf reader↗2020-02-11