CVE-2022-0517

published 2022-12-22

CVE-2022-0517: Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch…

high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN < 2.7.1.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
mozilla	firefox	—	—
mozilla	mozilla_vpn	>= unspecified < 2.7.1	2.7.1
mozilla	vpn	< 2.7.1	2.7.1

CWE-434